qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ipv6: prevent possible UAF in ip6_xmit() 

JIRA: https://issues.redhat.com/browse/RHEL-60232

commit 2d5ff7e339d04622d8282661df36151906d0e1c7
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Aug 20 16:08:59 2024 +0000

    ipv6: prevent possible UAF in ip6_xmit()

    If skb_expand_head() returns NULL, skb has been freed
    and the associated dst/idev could also have been freed.

    We must use rcu_read_lock() to prevent a possible UAF.

    Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Vasily Averin <vasily.averin@linux.dev>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
This commit is contained in:
CKI Backport Bot 2024-09-26 07:12:35 +00:00
parent ddb848fdae
commit 30b315f5ee
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/ipv6/ip6_output.c
View File

@ -281,11 +281,15 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
head_room += opt->opt_nflen + opt->opt_flen;
if (unlikely(head_room > skb_headroom(skb))) {
/* Make sure idev stays alive */
rcu_read_lock();
skb = skb_expand_head(skb, head_room);
if (!skb) {
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
rcu_read_unlock();
return -ENOBUFS;
}
rcu_read_unlock();
}
if (opt) {