This is a note to let you know that I've just added the patch titled
net: filter: fix possible use after free
to the 3.16-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-filter-fix-possible-use-after-free.patch
and it can be found in the queue-3.16 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From foo@baz Sun Oct 12 20:11:55 CEST 2014
From: Eric Dumazet <[email protected]>
Date: Thu, 11 Sep 2014 20:27:37 -0700
Subject: net: filter: fix possible use after free
From: Eric Dumazet <[email protected]>
[ No appicable upstream commit, this bug has been subsequently been
fixed as a side effect of other changes. ]
If kmemdup() fails, we free fp->orig_prog and return -ENOMEM
sk_attach_filter()
-> sk_filter_uncharge(sk, fp)
-> sk_filter_release(fp)
-> call_rcu(&fp->rcu, sk_filter_release_rcu)
-> sk_filter_release_rcu()
-> sk_release_orig_filter()
fprog = fp->orig_prog; // not NULL, but points to freed memory
kfree(fprog->filter); // use after free, potential corruption
kfree(fprog); // double free or corruption
Note: This was fixed in 3.17+ with commit 278571baca2a
("net: filter: simplify socket charging")
Found by AddressSanitizer
Signed-off-by: Eric Dumazet <[email protected]>
Fixes: a3ea269b8bcdb ("net: filter: keep original BPF program around")
Acked-by: Alexei Starovoitov <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/core/filter.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1318,6 +1318,7 @@ static int sk_store_orig_filter(struct s
fkprog->filter = kmemdup(fp->insns, fsize, GFP_KERNEL);
if (!fkprog->filter) {
kfree(fp->orig_prog);
+ fp->orig_prog = NULL;
return -ENOMEM;
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.16/gro-fix-aggregation-for-skb-using-frag_list.patch
queue-3.16/net-filter-fix-possible-use-after-free.patch
queue-3.16/l2tp-fix-race-while-getting-pmtu-on-ppp-pseudo-wire.patch
queue-3.16/packet-handle-too-big-packets-for-packet_v3.patch
queue-3.16/tcp-fix-tcp_release_cb-to-dispatch-via-address-family-for-mtu_reduced.patch
queue-3.16/tcp-don-t-use-timestamp-from-repaired-skb-s-to-calculate-rtt-v2.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
