Messages in this thread | | | Date | Tue, 11 Jan 2022 12:56:52 -0800 | Subject | Re: [PATCH net] ax25: use after free in ax25_connect | From | Eric Dumazet <> |
| |
On 1/10/22 20:20, Hangyu Hua wrote: > sk_to_ax25(sk) needs to be called after lock_sock(sk) to avoid UAF > caused by a race condition.
Can you describe what race condition you have found exactly ?
sk pointer can not change.
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > --- > net/ax25/af_ax25.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c > index cfca99e295b8..c5d62420a2a8 100644 > --- a/net/ax25/af_ax25.c > +++ b/net/ax25/af_ax25.c > @@ -1127,7 +1127,7 @@ static int __must_check ax25_connect(struct socket *sock, > struct sockaddr *uaddr, int addr_len, int flags) > { > struct sock *sk = sock->sk; > - ax25_cb *ax25 = sk_to_ax25(sk), *ax25t; > + ax25_cb *ax25, *ax25t; > struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr; > ax25_digi *digi = NULL; > int ct = 0, err = 0; > @@ -1155,6 +1155,8 @@ static int __must_check ax25_connect(struct socket *sock, > > lock_sock(sk); > > + ax25 = sk_to_ax25(sk); > + > /* deal with restarts */ > if (sock->state == SS_CONNECTING) { > switch (sk->sk_state) {
| |