[ovs-dev] [PATCH 1/2] compat: ip6_gre: fix possible use-after-free in ip6erspan_rcv

William Tu u9012063 at gmail.com
Tue Jul 9 19:22:55 UTC 2019


On Tue, Jul 9, 2019 at 8:25 AM Greg Rose <gvrose8192 at gmail.com> wrote:
>
> Upstream commit:
>     commit 2a3cabae4536edbcb21d344e7aa8be7a584d2afb
>     Author: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
>     Date:   Sat Apr 6 17:16:53 2019 +0200
>
>     net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
>
>     erspan_v6 tunnels run __iptunnel_pull_header on received skbs to remove
>     erspan header. This can determine a possible use-after-free accessing
>     pkt_md pointer in ip6erspan_rcv since the packet will be 'uncloned'
>     running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
>     been sent though a veth device). Fix it resetting pkt_md pointer after
>     __iptunnel_pull_header
>
>     Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
>     Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
>     Signed-off-by: David S. Miller <davem at davemloft.net>
>
> Fixes: c387d8177f20 ("compat: Add ipv6 GRE and IPV6 Tunneling")
> Cc: Lorenzo Bianconi <lorenzo.bianconi at redhat.com>
> Signed-off-by: Greg Rose <gvrose8192 at gmail.com>
> ---

Thanks for backporting this patch.
Acked-by: William Tu <u9012063 at gmail.com>


More information about the dev mailing list