lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <75d2f17bd349e220e8095730ef878c358385ae6f.camel@redhat.com> Date: Tue, 31 Oct 2023 13:15:08 +0100 From: Paolo Abeni <pabeni@...hat.com> To: Dan Carpenter <dan.carpenter@...aro.org>, Murali Karicheri <m-karicheri2@...com> Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Sebastian Andrzej Siewior <bigeasy@...utronix.de>, YueHaibing <yuehaibing@...wei.com>, Ziyang Xuan <william.xuanziyang@...wei.com>, netdev@...r.kernel.org, kernel-janitors@...r.kernel.org Subject: Re: [PATCH net] hsr: Prevent use after free in prp_create_tagged_frame() On Fri, 2023-10-27 at 15:19 +0300, Dan Carpenter wrote: > The prp_fill_rct() function can fail. In that situation, it frees the > skb and returns NULL. Meanwhile on the success path, it returns the > original skb. So it's straight forward to fix bug by using the returned > value. > > Fixes: 451d8123f897 ("net: prp: add packet handling support") > Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org> > --- > net/hsr/hsr_forward.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c > index b71dab630a87..80cdc6f6b34c 100644 > --- a/net/hsr/hsr_forward.c > +++ b/net/hsr/hsr_forward.c > @@ -342,9 +342,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame, > skb = skb_copy_expand(frame->skb_std, 0, > skb_tailroom(frame->skb_std) + HSR_HLEN, > GFP_ATOMIC); > - prp_fill_rct(skb, frame, port); > - > - return skb; > + return prp_fill_rct(skb, frame, port); > } > > static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev, Acked-by: Paolo Abeni <pabeni@...hat.com> (note both trees are currently locked now due to the pending PR; this tag is intended to speed-up the merge after the PR itself)
Powered by blists - more mailing lists