]> git.baikalelectronics.ru Git - kernel.git/commit
net: core: fix uses-after-free in list processing
authorEdward Cree <ecree@solarflare.com>
Mon, 9 Jul 2018 17:09:54 +0000 (18:09 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 9 Jul 2018 21:55:53 +0000 (14:55 -0700)
commit8a351bf4c2135d5850b9b186a6539939f26582b3
tree9e179eec6b8563653162dc8c5d933b454e21dcfc
parent7f86d2abc7d36ba79d13c05455d89b39dd1d6cd9
net: core: fix uses-after-free in list processing

In netif_receive_skb_list_internal(), all of skb_defer_rx_timestamp(),
 do_xdp_generic() and enqueue_to_backlog() can lead to kfree(skb).  Thus,
 we cannot wait until after they return to remove the skb from the list;
 instead, we remove it first and, in the pass case, add it to a sublist
 afterwards.
In the case of enqueue_to_backlog() we have already decided not to pass
 when we call the function, so we do not need a sublist.

Fixes: 80cc734ae6d7 ("net: core: Another step of skb receive list processing")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/dev.c