Messages in this thread | | | Subject | Re: [HELP] ATM: mpc, use-after-free | From | Eric Dumazet <> | Date | Mon, 11 Oct 2010 10:18:00 +0200 |
| |
Le lundi 11 octobre 2010 à 09:56 +0200, Jiri Slaby a écrit : > Hi, > > Stanse found this use-after-free: > > static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb) > { > ... > new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length); > > dev_kfree_skb_any(skb); > > FREE ^^^^^^^^^^^^^^^^^^^^^^^ > > if (new_skb == NULL) { > mpc->eg_ops->put(eg); > return; > } > skb_push(new_skb, eg->ctrl_info.DH_length); > skb_copy_to_linear_data(new_skb, eg->ctrl_info.DLL_header, > eg->ctrl_info.DH_length); > ... > memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); > > USE ^^^^^^^^^^^^ > > netif_rx(new_skb); > > I guess it should be ATM_SKB(new_skb), right?
Yes
- memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); + memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
> > The two problems are: > 1) obvious use-after-free > 2) ?data leak, since we don't erase the right memory? > > thanks,
Indeed, please submit a formal patch ?
Thanks
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |