| commit | 9a95492208ed8d6cdf5f72c650ffb7c7f3ee129a | [log] [tgz] |
|---|---|---|
| author | Toke Høiland-Jørgensen <[email protected]> | Wed Aug 31 23:52:18 2022 +0200 |
| committer | Michael Kochera <[email protected]> | Fri Oct 28 19:07:46 2022 +0000 |
| tree | eb0f2462c462f0960182311fe00efd67b5b5e86e | |
| parent | 41608fb91449bdcc9067bd348df89ba3174024d4 [diff] |
sch_sfb: Don't assume the skb is still around after enqueueing to child [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. BUG=b/254986004 TEST=http://sponge2/3f325319-4b95-4fb1-b44b-126c5461917e RELEASE_NOTE=Fixed CVE-2022-3586 in the Linux Kernel. cos-patch: security-moderate Reported-by: [email protected] # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke Høiland-Jørgensen <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Sasha Levin <[email protected]> Change-Id: I7750ea27fd4d98d0d4b69b226c0756cc130fa595 Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/38028 Tested-by: Cusky Presubmit Bot <[email protected]> Reviewed-by: Vaibhav Rustagi <[email protected]>