[net,0/3] fix slab-use-after-free in decode_session6

Message

shaozhengchao July 10, 2023, 9:40 a.m. UTC

When net device is configured with the qdisc of the sfb type, the cb
field of the SKB is used in both enqueue and decode session of packets,
and the fields overlap. When enqueuing packets, the cb field of skb is
used as a hash array. Also it is used as the header offset when decoding
session of skb. Therefore, it will cause slab-use-after-free in
decode_session6.
The cb field in the skb should not be used when sending packets. Set the
cb field of skb to 0 before decoding skb.

Zhengchao Shao (3):
  xfrm: fix slab-use-after-free in decode_session6
  ip6_vti: fix slab-use-after-free in decode_session6
  ip_vti: fix potential slab-use-after-free in decode_session6

 net/ipv4/ip_vti.c              | 4 ++--
 net/ipv6/ip6_vti.c             | 4 ++--
 net/xfrm/xfrm_interface_core.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

Comments

Steffen Klassert July 17, 2023, 7:42 a.m. UTC | #1

On Mon, Jul 10, 2023 at 05:40:50PM +0800, Zhengchao Shao wrote:
> When net device is configured with the qdisc of the sfb type, the cb
> field of the SKB is used in both enqueue and decode session of packets,
> and the fields overlap. When enqueuing packets, the cb field of skb is
> used as a hash array. Also it is used as the header offset when decoding
> session of skb. Therefore, it will cause slab-use-after-free in
> decode_session6.
> The cb field in the skb should not be used when sending packets. Set the
> cb field of skb to 0 before decoding skb.
> 
> Zhengchao Shao (3):
>   xfrm: fix slab-use-after-free in decode_session6
>   ip6_vti: fix slab-use-after-free in decode_session6
>   ip_vti: fix potential slab-use-after-free in decode_session6

Series applied, thanks a lot!