From 3086ba4fe020e87d5a48b5fe63ed2493a98caa2f Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 12 Sep 2024 15:52:33 +0800 Subject: [PATCH] ipv6: fix possible UAF in ip6_finish_output2() mainline inclusion from mainline-v6.11-rc5 commit da273b377ae0d9bd255281ed3c2adb228321687b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da273b377ae0d9bd255281ed3c2adb228321687b ------------------------------------------- If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet Cc: Vasily Averin Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski Conflicts: net/ipv6/ip6_output.c [The conflict occurs because the commit e415ed3a4b8b ipv6: use skb_expand_head in ip6_finish_output2") is not merged] Signed-off-by: Zhengchao Shao Signed-off-by: Zhang Changzhong --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index f0c94aaa039f..8a36c16c2450 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } skb = nskb; } + /* Make sure idev stays alive */ + rcu_read_lock(); if (skb && pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { kfree_skb(skb); @@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } if (!skb) { IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { -- Gitee