redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

udp: fix possible user after free in error handler 

Similar to the previous commit, this addresses the same issue for
ipv4: use a single fetch operation and use the correct rcu
annotation.

Fixes: e7cc082455 ("udp: Support for error handlers of tunnels with arbitrary destination port")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Paolo Abeni 2019-02-21 17:44:00 +01:00 committed by David S. Miller
parent 424a7cd078
commit 92b9536423
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/ipv4/udp.c
View File

@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info)
for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
int (*handler)(struct sk_buff *skb, u32 info);
const struct ip_tunnel_encap_ops *encap;
if (!iptun_encaps[i])
encap = rcu_dereference(iptun_encaps[i]);
if (!encap)
continue;
handler = rcu_dereference(iptun_encaps[i]->err_handler);
handler = encap->err_handler;
if (handler && !handler(skb, info))
return 0;
}