lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 003/346] macvlan: Fix potential use-after free for broadcasts
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Herbert Xu <herbert@gondor.apana.org.au>

    commit 260916dfb48c374f7840f3b86e69afd3afdb6e96 upstream.

    When we postpone a broadcast packet we save the source port in
    the skb if it is local. However, the source port can disappear
    before we get a chance to process the packet.

    This patch fixes this by holding a ref count on the netdev.

    It also delays the skb->cb modification until after we allocate
    the new skb as you should not modify shared skbs.

    Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/net/macvlan.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/drivers/net/macvlan.c
    +++ b/drivers/net/macvlan.c
    @@ -234,11 +234,14 @@ static void macvlan_process_broadcast(st

    rcu_read_unlock();

    + if (src)
    + dev_put(src->dev);
    kfree_skb(skb);
    }
    }

    static void macvlan_broadcast_enqueue(struct macvlan_port *port,
    + const struct macvlan_dev *src,
    struct sk_buff *skb)
    {
    struct sk_buff *nskb;
    @@ -248,8 +251,12 @@ static void macvlan_broadcast_enqueue(st
    if (!nskb)
    goto err;

    + MACVLAN_SKB_CB(nskb)->src = src;
    +
    spin_lock(&port->bc_queue.lock);
    if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) {
    + if (src)
    + dev_hold(src->dev);
    __skb_queue_tail(&port->bc_queue, nskb);
    err = 0;
    }
    @@ -296,8 +303,7 @@ static rx_handler_result_t macvlan_handl
    goto out;
    }

    - MACVLAN_SKB_CB(skb)->src = src;
    - macvlan_broadcast_enqueue(port, skb);
    + macvlan_broadcast_enqueue(port, src, skb);

    return RX_HANDLER_PASS;
    }
    \
     
     \ /
      Last update: 2016-11-14 04:42    [W:4.037 / U:25.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site