redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

udpv6: fix possible user after free in error handler 

Before derefencing the encap pointer, commit e7cc082455 ("udp: Support
for error handlers of tunnels with arbitrary destination port") checks
for a NULL value, but the two fetch operation can race with removal.
Fix the above using a single access.
Also fix a couple of type annotations, to make sparse happy.

Fixes: e7cc082455 ("udp: Support for error handlers of tunnels with arbitrary destination port")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Paolo Abeni 2019-02-21 17:43:59 +01:00 committed by David S. Miller
parent 5de362df44
commit 424a7cd078
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/ipv6/udp.c
View File

@ -420,17 +420,19 @@ EXPORT_SYMBOL(udpv6_encap_enable);
*/
static int __udp6_lib_err_encap_no_sk(struct sk_buff *skb,
struct inet6_skb_parm *opt,
u8 type, u8 code, int offset, u32 info)
u8 type, u8 code, int offset, __be32 info)
{
int i;
for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
int (*handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
u8 type, u8 code, int offset, u32 info);
u8 type, u8 code, int offset, __be32 info);
const struct ip6_tnl_encap_ops *encap;
if (!ip6tun_encaps[i])
encap = rcu_dereference(ip6tun_encaps[i]);
if (!encap)
continue;
handler = rcu_dereference(ip6tun_encaps[i]->err_handler);
handler = encap->err_handler;
if (handler && !handler(skb, opt, type, code, offset, info))
return 0;
}