lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 1 Apr 2021 02:35:45 -0700 From: Lv Yunlong <lyl2019@...l.ustc.edu.cn> To: dhowells@...hat.com, davem@...emloft.net, kuba@...nel.org Cc: linux-afs@...ts.infradead.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Lv Yunlong <lyl2019@...l.ustc.edu.cn> Subject: [PATCH] net/rxrpc: Fix a use after free in rxrpc_input_packet In the case RXRPC_PACKET_TYPE_DATA of rxrpc_input_packet, if skb_unshare(skb,..) failed, it will free the skb and return NULL. But if skb_unshare() return NULL, the freed skb will be used by rxrpc_eaten_skb(skb,..). I see that rxrpc_eaten_skb() is used to drop a ref of skb. As the skb is already freed in skb_unshare() on error, my patch removes the rxrpc_eaten_skb() to avoid the uaf. Fixes: d0d5c0cd1e711 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Signed-off-by: Lv Yunlong <lyl2019@...l.ustc.edu.cn> --- net/rxrpc/input.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c index dc201363f2c4..9ba408064465 100644 --- a/net/rxrpc/input.c +++ b/net/rxrpc/input.c @@ -1281,10 +1281,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb) */ if (sp->hdr.securityIndex != 0) { struct sk_buff *nskb = skb_unshare(skb, GFP_ATOMIC); - if (!nskb) { - rxrpc_eaten_skb(skb, rxrpc_skb_unshared_nomem); + if (!nskb) goto out; - } if (nskb != skb) { rxrpc_eaten_skb(skb, rxrpc_skb_received); -- 2.25.1
Powered by blists - more mailing lists