Unverified Commit 93dc6516 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1729 fix CVE-2023-4128 in OLK510 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RHW5R5YZ4QMNY3YD7F65XJ6AFMBVMCOF/ 
fix CVE-2023-4128 in OLK510

valis (3):
  net/sched: cls_u32: No longer copy tcf_result on update to avoid
    use-after-free
  net/sched: cls_fw: No longer copy tcf_result on update to avoid
    use-after-free
  net/sched: cls_route: No longer copy tcf_result on update to avoid
    use-after-free


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I7SAP1 
 
Link:https://gitee.com/openeuler/kernel/pulls/1729

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents b3ae81a3 a360f541

net/sched/cls_fw.c

+0 −1
Original line number Diff line number Diff line
@@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb, 
			return -ENOBUFS;



		fnew->id = f->id;

		fnew->res = f->res;

		fnew->ifindex = f->ifindex;

		fnew->tp = f->tp;

net/sched/cls_route.c

+0 −1
Original line number Diff line number Diff line
@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, 
	if (fold) {

		f->id = fold->id;

		f->iif = fold->iif;

		f->res = fold->res;

		f->handle = fold->handle;



		f->tp = fold->tp;

net/sched/cls_u32.c

+0 −1
Original line number Diff line number Diff line
@@ -812,7 +812,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, 


	new->ifindex = n->ifindex;

	new->fshift = n->fshift;

	new->res = n->res;

	new->flags = n->flags;

	RCU_INIT_POINTER(new->ht_down, ht);