Commit 3086ba4f authored by Eric Dumazet's avatar Eric Dumazet Committed by Zhang Changzhong
Browse files

ipv6: fix possible UAF in ip6_finish_output2() 

mainline inclusion
from mainline-v6.11-rc5
commit da273b377ae0d9bd255281ed3c2adb228321687b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO
CVE: CVE-2024-44986

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da273b377ae0d9bd255281ed3c2adb228321687b



-------------------------------------------

If skb_expand_head() returns NULL, skb has been freed
and associated dst/idev could also have been freed.

We need to hold rcu_read_lock() to make sure the dst and
associated idev are alive.

Fixes: 5796015f ("ipv6: allocate enough headroom in ip6_finish_output2()")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Vasily Averin <vasily.averin@linux.dev>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>

Conflicts:
	net/ipv6/ip6_output.c
[The conflict occurs because the commit e415ed3a ipv6: use
skb_expand_head in ip6_finish_output2") is not merged]
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 8d7099da

net/ipv6/ip6_output.c

+4 −0
Original line number Diff line number Diff line
@@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * 
			}

			skb = nskb;

		}

		/* Make sure idev stays alive */

		rcu_read_lock();

		if (skb &&

		    pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {

			kfree_skb(skb);
@@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * 
		}

		if (!skb) {

			IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);

			rcu_read_unlock();

			return -ENOMEM;

		}

		rcu_read_unlock();

	}



	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {