diff options
| author |   Herbert Xu <herbert@gondor.apana.org.au> | 2016-06-01 11:43:00 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2016-06-01 17:48:46 -0700 |
| commit | 260916dfb48c374f7840f3b86e69afd3afdb6e96 (patch) | |
| tree | f3d2d75d159a68ee886d04cd130d05107f388bbd /drivers/net/macvlan.c | |
| parent | udp: avoid csum_partial() for validated skb (diff) | |
| download | linux-dev-260916dfb48c374f7840f3b86e69afd3afdb6e96.tar.xz linux-dev-260916dfb48c374f7840f3b86e69afd3afdb6e96.zip | |
macvlan: Fix potential use-after free for broadcasts
When we postpone a broadcast packet we save the source port in
the skb if it is local. However, the source port can disappear
before we get a chance to process the packet.
This patch fixes this by holding a ref count on the netdev.
It also delays the skb->cb modification until after we allocate
the new skb as you should not modify shared skbs.
Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/macvlan.c')
| -rw-r--r-- | drivers/net/macvlan.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index cb01023eab41..a71fa592b1fb 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -305,11 +305,14 @@ static void macvlan_process_broadcast(struct work_struct *w) rcu_read_unlock(); + if (src) + dev_put(src->dev); kfree_skb(skb); } } static void macvlan_broadcast_enqueue(struct macvlan_port *port, + const struct macvlan_dev *src, struct sk_buff *skb) { struct sk_buff *nskb; @@ -319,8 +322,12 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port, if (!nskb) goto err; + MACVLAN_SKB_CB(nskb)->src = src; + spin_lock(&port->bc_queue.lock); if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) { + if (src) + dev_hold(src->dev); __skb_queue_tail(&port->bc_queue, nskb); err = 0; } @@ -429,8 +436,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) goto out; } - MACVLAN_SKB_CB(skb)->src = src; - macvlan_broadcast_enqueue(port, skb); + macvlan_broadcast_enqueue(port, src, skb); return RX_HANDLER_PASS; } |