lkml.org 
[lkml]   [2023]   [Nov]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] nbd: pass nbd_sock to nbd_read_reply() instead of index
Date

On Mon, 11 Sep 2023 10:33:08 +0800, linan666@huaweicloud.com wrote:
> If a socket is processing ioctl 'NBD_SET_SOCK', config->socks might be
> krealloc in nbd_add_socket(), and a garbage request is received now, a UAF
> may occurs.
>
> T1
> nbd_ioctl
> __nbd_ioctl
> nbd_add_socket
> blk_mq_freeze_queue
> T2
> recv_work
> nbd_read_reply
> sock_xmit
> krealloc config->socks
> def config->socks
>
> [...]

Applied, thanks!

[1/1] nbd: pass nbd_sock to nbd_read_reply() instead of index
commit: 98c598afc22d4e43c2ad91860b65996d0c099a5d

Best regards,
--
Jens Axboe



\
 
 \ /
  Last update: 2023-11-21 15:43    [W:0.070 / U:0.448 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site