diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2019-02-21 19:44:00 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-02-23 03:05:11 +0300 |
| commit | 92b95364235b6441a36861ff0ca4541a13351d60 (patch) | |
| tree | a3c10fb8d15b866a0812ed3d3460f09d52968978 | |
| parent | 424a7cd078401591fc45587ffb2c012d7f402fb7 (diff) | |
| download | linux-92b95364235b6441a36861ff0ca4541a13351d60.tar.xz | |
udp: fix possible user after free in error handler
Similar to the previous commit, this addresses the same issue for
ipv4: use a single fetch operation and use the correct rcu
annotation.
Fixes: e7cc082455cb ("udp: Support for error handlers of tunnels with arbitrary destination port")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/udp.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 5c3cd5d84a6f..372fdc5381a9 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info) for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) { int (*handler)(struct sk_buff *skb, u32 info); + const struct ip_tunnel_encap_ops *encap; - if (!iptun_encaps[i]) + encap = rcu_dereference(iptun_encaps[i]); + if (!encap) continue; - handler = rcu_dereference(iptun_encaps[i]->err_handler); + handler = encap->err_handler; if (handler && !handler(skb, info)) return 0; } |