Unverified Commit 1b77b8cd authored Oct 28, 2024 by openeuler-ci-bot Committed by Gitee Oct 28, 2024

!12486 gtp: Fix CVE-2024-46677

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7BLOBSVN76GDUNXZSOE4DX2ZRVTUK3BX/ 
fix CVE-2024-46677

Cong Wang (1):
  gtp: fix a potential NULL pointer dereference

Eric Dumazet (1):
  gtp: make sure only SOCK_DGRAM UDP sockets are accepted


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAR4H8 
 
Link:https://gitee.com/openeuler/kernel/pulls/12486

 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

parents 5b1610d4 ffc5282b

drivers/net/gtp.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -809,22 +809,24 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
		sock = sockfd_lookup(fd, &err);
		if (!sock) {
		pr_debug("gtp socket fd=%d not found\n", fd);
		return NULL;
		return ERR_PTR(err);
		}

		if (sock->sk->sk_protocol != IPPROTO_UDP) {
		sk = sock->sk;
		if (sk->sk_protocol != IPPROTO_UDP \|\|
		sk->sk_type != SOCK_DGRAM \|\|
		(sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) {
		pr_debug("socket fd=%d not UDP\n", fd);
		sk = ERR_PTR(-EINVAL);
		goto out_sock;
		}

		lock_sock(sock->sk);
		if (sock->sk->sk_user_data) {
		lock_sock(sk);
		if (sk->sk_user_data) {
		sk = ERR_PTR(-EBUSY);
		goto out_rel_sock;
		}

		sk = sock->sk;
		sock_hold(sk);

		tuncfg.sk_user_data = gtp;