diff options
author | David Howells <dhowells@redhat.com> | 2020-01-24 23:08:04 +0000 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-01-27 10:56:30 +0100 |
commit | 122d74fac84204b9a98263636f6f9a3b2e665639 (patch) | |
tree | 0adfab85c39f687d872855040dd33a4d2ba029e0 /lib/nodemask.c | |
parent | net_sched: ematch: reject invalid TCF_EM_SIMPLE (diff) | |
download | linux-dev-122d74fac84204b9a98263636f6f9a3b2e665639.tar.xz linux-dev-122d74fac84204b9a98263636f6f9a3b2e665639.zip |
rxrpc: Fix use-after-free in rxrpc_receive_data()
The subpacket scanning loop in rxrpc_receive_data() references the
subpacket count in the private data part of the sk_buff in the loop
termination condition. However, when the final subpacket is pasted into
the ring buffer, the function is no longer has a ref on the sk_buff and
should not be looking at sp->* any more. This point is actually marked in
the code when skb is cleared (but sp is not - which is an error).
Fix this by caching sp->nr_subpackets in a local variable and using that
instead.
Also clear 'sp' to catch accesses after that point.
This can show up as an oops in rxrpc_get_skb() if sp->nr_subpackets gets
trashed by the sk_buff getting freed and reused in the meantime.
Fixes: e2de6c404898 ("rxrpc: Use info in skbuff instead of reparsing a jumbo packet")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/nodemask.c')
0 files changed, 0 insertions, 0 deletions