mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
commit76e42ae831
upstream. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Fixes:e35a8ee599
("net: sched: fw use RCU") Reported-by: valis <sec@valis.email> Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg> Signed-off-by: valis <sec@valis.email> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Victor Nogueira <victor@mojatatu.com> Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> Reviewed-by: M A Ramdhan <ramdhan@starlabs.sg> Link: https://lore.kernel.org/r/20230729123202.72406-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ Fixed small conflict as 'fnew->ifindex' assignment is not protected by CONFIG_NET_CLS_IND on upstream sincea51486266c
] Signed-off-by: Luiz Capitulino <luizcap@amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2bc3d6ac70
commit
530a85ea74
1 changed files with 0 additions and 1 deletions
|
@ -281,7 +281,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
|
|||
return -ENOBUFS;
|
||||
|
||||
fnew->id = f->id;
|
||||
fnew->res = f->res;
|
||||
#ifdef CONFIG_NET_CLS_IND
|
||||
fnew->ifindex = f->ifindex;
|
||||
#endif /* CONFIG_NET_CLS_IND */
|
||||
|
|
Loading…
Reference in a new issue