mirror of
https://github.com/torvalds/linux.git
synced 2024-11-22 04:02:20 +00:00
net/smc: prevent NULL pointer dereference in txopt_get
Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create()
copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6.
In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically
point to the same address, when smc_create_clcsk() stores the newly
created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted
into clcsock. This causes NULL pointer dereference and various other
memory corruptions.
To solve this problem, you need to initialize ipv6_pinfo_offset, add a
smc6_sock structure, and then add ipv6_pinfo as the second member of
the smc_sock structure.
Reported-by: syzkaller <syzkaller@googlegroups.com>
Fixes: d25a92ccae
("net/smc: Introduce IPPROTO_SMC")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
1bb3c548e4
commit
98d4435efc
@ -284,6 +284,9 @@ struct smc_connection {
|
||||
|
||||
struct smc_sock { /* smc sock container */
|
||||
struct sock sk;
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
struct ipv6_pinfo *pinet6;
|
||||
#endif
|
||||
struct socket *clcsock; /* internal tcp socket */
|
||||
void (*clcsk_state_change)(struct sock *sk);
|
||||
/* original stat_change fct. */
|
||||
|
@ -60,6 +60,11 @@ static struct inet_protosw smc_inet_protosw = {
|
||||
};
|
||||
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
struct smc6_sock {
|
||||
struct smc_sock smc;
|
||||
struct ipv6_pinfo inet6;
|
||||
};
|
||||
|
||||
static struct proto smc_inet6_prot = {
|
||||
.name = "INET6_SMC",
|
||||
.owner = THIS_MODULE,
|
||||
@ -67,9 +72,10 @@ static struct proto smc_inet6_prot = {
|
||||
.hash = smc_hash_sk,
|
||||
.unhash = smc_unhash_sk,
|
||||
.release_cb = smc_release_cb,
|
||||
.obj_size = sizeof(struct smc_sock),
|
||||
.obj_size = sizeof(struct smc6_sock),
|
||||
.h.smc_hash = &smc_v6_hashinfo,
|
||||
.slab_flags = SLAB_TYPESAFE_BY_RCU,
|
||||
.ipv6_pinfo_offset = offsetof(struct smc6_sock, inet6),
|
||||
};
|
||||
|
||||
static const struct proto_ops smc_inet6_stream_ops = {
|
||||
|
Loading…
Reference in New Issue
Block a user