shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

neighbour: use RCU protection in __neigh_notify()

Browse Source 
[ Upstream commit becbd5850c03ed33b232083dd66c6e38c0c0e569 ]

__neigh_notify() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.

Fixes: 426b5303eb ("[NETNS]: Modify the neighbour table code so it handles multiple network namespaces")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250207135841.1948589-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Eric Dumazet
2025-02-07 13:58:35 +00:00
committed by Greg Kroah-Hartman
parent 9b4d091de5
commit 784eb23762
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
net/core/neighbour.c
View File

@@ -3498,10 +3498,12 @@ static const struct seq_operations neigh_stat_seq_ops = {
static void __neigh_notify(struct neighbour *n, int type, int flags, static void __neigh_notify(struct neighbour *n, int type, int flags,
u32 pid) u32 pid)
{ {
struct net *net = dev_net(n->dev);
struct sk_buff *skb; struct sk_buff *skb;
int err = -ENOBUFS; int err = -ENOBUFS;
struct net *net;
rcu_read_lock();
net = dev_net_rcu(n->dev);
skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC); skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
if (skb == NULL) if (skb == NULL)
goto errout; goto errout;
@@ -3514,9 +3516,11 @@ static void __neigh_notify(struct neighbour *n, int type, int flags,
goto errout; goto errout;
} }
rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC); rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
return; goto out;
errout: errout:
rtnl_set_sk_err(net, RTNLGRP_NEIGH, err); rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
out:
rcu_read_unlock();
} }
void neigh_app_ns(struct neighbour *n) void neigh_app_ns(struct neighbour *n)