lkml.org 
[lkml]   [2017]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
SubjectRe: net/ipv4: use-after-free in ipv4_datagram_support_cmsg
On Wed, Apr 12, 2017 at 8:39 AM, Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
> ===================
>> BUG: KASAN: use-after-free in ipv4_datagram_support_cmsg
>> net/ipv4/ip_sockglue.c:500 [inline] at addr ffff880059be0128
>
> Thanks for the report. This is accessing skb->dev from within recvmsg() at line
>
> info->ipi_ifindex = skb->dev->ifindex;
>
> Introduced in 829ae9d61165 ("net-timestamp: allow reading recv cmsg on
> errqueue with origin tstamp"). At this time the device may indeed have
> gone away. I'm having a look at a way to read this in the receive BH
> and store the ifindex.

Why not use skb_iif?

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ebd953b..a2aef45 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -497,7 +497,7 @@ static bool ipv4_datagram_support_cmsg(const
struct sock *sk,

info = PKTINFO_SKB_CB(skb);
info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
- info->ipi_ifindex = skb->dev->ifindex;
+ info->ipi_ifindex = skb->skb_iif;
return true;
}
\
 
 \ /
  Last update: 2017-04-12 22:09    [W:0.049 / U:1.536 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site