]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: ipset: fix suspicious RCU usage in find_set_and_id
authorKadlecsik József <kadlec@blackhole.kfki.hu>
Sat, 25 Jan 2020 19:39:25 +0000 (20:39 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 29 Jan 2020 17:34:46 +0000 (18:34 +0100)
commita3a554a3c84b309a7e6fbed6466560a4ef5be668
tree734a5ef3cf9088a851c29056ad9c65ef98eb3cbd
parent7f9ddc9562aee20f9df4874f50bdadc65d8fcd5e
netfilter: ipset: fix suspicious RCU usage in find_set_and_id

find_set_and_id() is called when the NFNL_SUBSYS_IPSET mutex is held.
However, in the error path there can be a follow-up recvmsg() without
the mutex held. Use the start() function of struct netlink_dump_control
instead of dump() to verify and report if the specified set does not
exist.

Thanks to Pablo Neira Ayuso for helping me to understand the subleties
of the netlink protocol.

Reported-by: syzbot+fc69d7cb21258ab4ae4d@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/ipset/ip_set_core.c