Unverified Commit f67f570a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14773 CVE-2024-56642 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/4OPJA6XJUXW4UKMZO22IBGQZUMSQRTO3/ 
CVE-2024-56642

Eric Dumazet (1):
  tipc: fix NULL deref in cleanup_bearer()

Kuniyuki Iwashima (1):
  tipc: Fix use-after-free of kernel socket in cleanup_bearer().

Xin Long (1):
  tipc: remove ub->ubsock checks


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IBEAPI 
 
Link:https://gitee.com/openeuler/kernel/pulls/14773

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 3cca5684 8375b553

net/tipc/udp_media.c

+11 −8
Original line number Diff line number Diff line
@@ -753,12 +753,12 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b, 
	else

		err = tipc_udp_rcast_add(b, &remote);

	if (err)

		goto err;

		goto free;



	return 0;

err:

	if (ub->ubsock)

free:

	udp_tunnel_sock_release(ub->ubsock);

err:

	kfree(ub);

	return err;

}
@@ -768,16 +768,20 @@ static void cleanup_bearer(struct work_struct *work) 
{

	struct udp_bearer *ub = container_of(work, struct udp_bearer, work);

	struct udp_replicast *rcast, *tmp;

	struct tipc_net *tn;



	list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {

		list_del_rcu(&rcast->list);

		kfree_rcu(rcast, rcu);

	}



	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);

	if (ub->ubsock)

	tn = tipc_net(sock_net(ub->ubsock->sk));



	udp_tunnel_sock_release(ub->ubsock);



	/* Note: could use a call_rcu() to avoid another synchronize_net() */

	synchronize_net();

	atomic_dec(&tn->wq_count);

	kfree(ub);

}
@@ -791,7 +795,6 @@ static void tipc_udp_disable(struct tipc_bearer *b) 
		pr_err("UDP bearer instance not found\n");

		return;

	}

	if (ub->ubsock)

	sock_set_flag(ub->ubsock->sk, SOCK_DEAD);

	RCU_INIT_POINTER(ub->bearer, NULL);