[HELP] ATM: mpc, use-after-free
From: Jiri Slaby
Date: Mon Oct 11 2010 - 03:56:54 EST
Hi,
Stanse found this use-after-free:
static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
{
...
new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length);
dev_kfree_skb_any(skb);
FREE ^^^^^^^^^^^^^^^^^^^^^^^
if (new_skb == NULL) {
mpc->eg_ops->put(eg);
return;
}
skb_push(new_skb, eg->ctrl_info.DH_length);
skb_copy_to_linear_data(new_skb, eg->ctrl_info.DLL_header,
eg->ctrl_info.DH_length);
...
memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
USE ^^^^^^^^^^^^
netif_rx(new_skb);
I guess it should be ATM_SKB(new_skb), right?
The two problems are:
1) obvious use-after-free
2) ?data leak, since we don't erase the right memory?
thanks,
--
js
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/