mirror of
https://github.com/torvalds/linux.git
synced 2024-11-23 04:31:50 +00:00
a7b42969d6
One extra conn_get() is needed in tipc_conn_alloc(), as after
tipc_conn_alloc() is called, tipc_conn_close() may free this
con before deferencing it in tipc_topsrv_accept():
tipc_conn_alloc();
newsk = newsock->sk;
<---- tipc_conn_close();
write_lock_bh(&sk->sk_callback_lock);
newsk->sk_data_ready = tipc_conn_data_ready;
Then an uaf issue can be triggered:
BUG: KASAN: use-after-free in tipc_topsrv_accept+0x1e7/0x370 [tipc]
Call Trace:
<TASK>
dump_stack_lvl+0x33/0x46
print_report+0x178/0x4b0
kasan_report+0x8c/0x100
kasan_check_range+0x179/0x1e0
tipc_topsrv_accept+0x1e7/0x370 [tipc]
process_one_work+0x6a3/0x1030
worker_thread+0x8a/0xdf0
This patch fixes it by holding it in tipc_conn_alloc(), then after
all accessing in tipc_topsrv_accept() releasing it. Note when does
this in tipc_topsrv_kern_subscr(), as tipc_conn_rcv_sub() returns
0 or -1 only, we don't need to check for "> 0".
Fixes:
|
||
|---|---|---|
| .. | ||
| addr.c | ||
| addr.h | ||
| bcast.c | ||
| bcast.h | ||
| bearer.c | ||
| bearer.h | ||
| core.c | ||
| core.h | ||
| crypto.c | ||
| crypto.h | ||
| diag.c | ||
| discover.c | ||
| discover.h | ||
| eth_media.c | ||
| group.c | ||
| group.h | ||
| ib_media.c | ||
| Kconfig | ||
| link.c | ||
| link.h | ||
| Makefile | ||
| monitor.c | ||
| monitor.h | ||
| msg.c | ||
| msg.h | ||
| name_distr.c | ||
| name_distr.h | ||
| name_table.c | ||
| name_table.h | ||
| net.c | ||
| net.h | ||
| netlink_compat.c | ||
| netlink.c | ||
| netlink.h | ||
| node.c | ||
| node.h | ||
| socket.c | ||
| socket.h | ||
| subscr.c | ||
| subscr.h | ||
| sysctl.c | ||
| topsrv.c | ||
| topsrv.h | ||
| trace.c | ||
| trace.h | ||
| udp_media.c | ||
| udp_media.h | ||