| Message ID | 20240820160859.3786976-3-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | da273b377ae0d9bd255281ed3c2adb228321687b |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ipv6: fix possible UAF in output paths | expand |
On 8/20/24 10:08 AM, Eric Dumazet wrote: > If skb_expand_head() returns NULL, skb has been freed > and associated dst/idev could also have been freed. > > We need to hold rcu_read_lock() to make sure the dst and > associated idev are alive. > > Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Vasily Averin <vasily.averin@linux.dev> > --- > net/ipv6/ip6_output.c | 4 ++++ > 1 file changed, 4 insertions(+) > Reviewed-by: David Ahern <dsahern@kernel.org>
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index f7b53effc80f8b3b7a839f58097d021a11f9eb37..1b9ebee7308f02a626c766de1794e6b114ae8554 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -70,11 +70,15 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * /* Be paranoid, rather than too clever. */ if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) { + /* Make sure idev stays alive */ + rcu_read_lock(); skb = skb_expand_head(skb, hh_len); if (!skb) { IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } hdr = ipv6_hdr(skb);
If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vasily Averin <vasily.averin@linux.dev> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+)