| Message ID | 20230705161530.52003-1-ramdhan@starlabs.sg (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 0323bce598eea038714f941ce2b22541c46d488f |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/sched: cls_fw: Fix improper refcount update leads to use-after-free | expand |
On 05/07/2023 13:15, jhs@mojatatu.com wrote: > From: M A Ramdhan <ramdhan@starlabs.sg> > > In the event of a failure in tcf_change_indev(), fw_set_parms() will > immediately return an error after incrementing or decrementing > reference counter in tcf_bind_filter(). If attacker can control > reference counter to zero and make reference freed, leading to > use after free. > > In order to prevent this, move the point of possible failure above the > point where the TC_FW_CLASSID is handled. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Reported-by: M A Ramdhan <ramdhan@starlabs.sg> > Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg> > Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> LGTM, Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> > --- > net/sched/cls_fw.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c > index ae9439a6c56c..8641f8059317 100644 > --- a/net/sched/cls_fw.c > +++ b/net/sched/cls_fw.c > @@ -212,11 +212,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, > if (err < 0) > return err; > > - if (tb[TCA_FW_CLASSID]) { > - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); > - tcf_bind_filter(tp, &f->res, base); > - } > - > if (tb[TCA_FW_INDEV]) { > int ret; > ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); > @@ -233,6 +228,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, > } else if (head->mask != 0xFFFFFFFF) > return err; > > + if (tb[TCA_FW_CLASSID]) { > + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); > + tcf_bind_filter(tp, &f->res, base); > + } > + > return 0; > } >
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Wed, 5 Jul 2023 12:15:30 -0400 you wrote: > From: M A Ramdhan <ramdhan@starlabs.sg> > > In the event of a failure in tcf_change_indev(), fw_set_parms() will > immediately return an error after incrementing or decrementing > reference counter in tcf_bind_filter(). If attacker can control > reference counter to zero and make reference freed, leading to > use after free. > > [...] Here is the summary with links: - [net] net/sched: cls_fw: Fix improper refcount update leads to use-after-free https://git.kernel.org/netdev/net/c/0323bce598ee You are awesome, thank you!
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index ae9439a6c56c..8641f8059317 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -212,11 +212,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - if (tb[TCA_FW_INDEV]) { int ret; ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); @@ -233,6 +228,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; }