lkml.org 
[lkml]   [2021]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] net/rxrpc: Fix a use after free in rxrpc_input_packet
Date
In the case RXRPC_PACKET_TYPE_DATA of rxrpc_input_packet, if
skb_unshare(skb,..) failed, it will free the skb and return NULL.
But if skb_unshare() return NULL, the freed skb will be used by
rxrpc_eaten_skb(skb,..).

I see that rxrpc_eaten_skb() is used to drop a ref of skb. As the skb
is already freed in skb_unshare() on error, my patch removes the
rxrpc_eaten_skb() to avoid the uaf.

Fixes: d0d5c0cd1e711 ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
net/rxrpc/input.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index dc201363f2c4..9ba408064465 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -1281,10 +1281,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
*/
if (sp->hdr.securityIndex != 0) {
struct sk_buff *nskb = skb_unshare(skb, GFP_ATOMIC);
- if (!nskb) {
- rxrpc_eaten_skb(skb, rxrpc_skb_unshared_nomem);
+ if (!nskb)
goto out;
- }

if (nskb != skb) {
rxrpc_eaten_skb(skb, rxrpc_skb_received);
--
2.25.1

\
 
 \ /
  Last update: 2021-04-01 11:38    [W:0.033 / U:0.484 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site