diff options
author | Eric Dumazet <edumazet@google.com> | 2018-09-14 15:02:31 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-09-17 10:56:02 -0400 |
commit | bbd6528d28c1b8e80832b3b018ec402b6f5c3215 (patch) | |
tree | 4c7e9f26af82fd34dcbc6520091f046982388a10 | |
parent | a7f38002fb69b44f8fc622ecb838665d0b8666af (diff) |
ipv6: fix possible use-after-free in ip6_xmit()
In the unlikely case ip6_xmit() has to call skb_realloc_headroom(),
we need to call skb_set_owner_w() before consuming original skb,
otherwise we risk a use-after-free.
Bring IPv6 in line with what we do in IPv4 to fix this.
Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/ipv6/ip6_output.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 16f200f06500..f9f8f554d141 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c | |||
@@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, | |||
219 | kfree_skb(skb); | 219 | kfree_skb(skb); |
220 | return -ENOBUFS; | 220 | return -ENOBUFS; |
221 | } | 221 | } |
222 | if (skb->sk) | ||
223 | skb_set_owner_w(skb2, skb->sk); | ||
222 | consume_skb(skb); | 224 | consume_skb(skb); |
223 | skb = skb2; | 225 | skb = skb2; |
224 | /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, | ||
225 | * it is safe to call in our context (socket lock not held) | ||
226 | */ | ||
227 | skb_set_owner_w(skb, (struct sock *)sk); | ||
228 | } | 226 | } |
229 | if (opt->opt_flen) | 227 | if (opt->opt_flen) |
230 | ipv6_push_frag_opts(skb, opt, &proto); | 228 | ipv6_push_frag_opts(skb, opt, &proto); |