David Ahern
e671f1cc58
vrf: Fix use-after-free in vrf_xmit
[ Upstream commit f7887d40e5 ]
KASAN detected a use-after-free:
[ 269.467067] BUG: KASAN: use-after-free in vrf_xmit+0x7f1/0x827 [vrf] at addr ffff8800350a21c0
[ 269.467067] Read of size 4 by task ssh/1879
[ 269.467067] CPU: 1 PID: 1879 Comm: ssh Not tainted 4.10.0+ #249
[ 269.467067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 269.467067] Call Trace:
[ 269.467067] dump_stack+0x81/0xb6
[ 269.467067] kasan_object_err+0x21/0x78
[ 269.467067] kasan_report+0x2f7/0x450
[ 269.467067] ? vrf_xmit+0x7f1/0x827 [vrf]
[ 269.467067] ? ip_output+0xa4/0xdb
[ 269.467067] __asan_load4+0x6b/0x6d
[ 269.467067] vrf_xmit+0x7f1/0x827 [vrf]
...
Which corresponds to the skb access after xmit handling. Fix by saving
skb->len and using the saved value to update stats.
Fixes: 193125dbd8 ("net: Introduce VRF device driver")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-03-22 12:04:16 +01:00
..
2016-09-30 10:18:36 +02:00
2017-03-12 06:37:28 +01:00
2016-12-10 19:07:23 +01:00
2017-03-18 19:09:56 +08:00
2016-01-06 15:06:27 -05:00
2017-02-14 15:22:51 -08:00
2017-03-15 09:57:15 +08:00
2016-04-12 09:08:49 -07:00
2017-02-04 09:45:09 +01:00
2017-01-06 11:16:17 +01:00
2016-06-24 10:18:17 -07:00
2017-02-04 09:45:09 +01:00
2016-01-06 16:20:13 -05:00
2016-04-20 15:42:03 +09:00
2017-03-12 06:37:30 +01:00
2015-12-18 12:24:52 -08:00
2016-12-10 19:07:24 +01:00
2017-02-18 16:39:27 +01:00
2017-02-18 16:39:27 +01:00
2016-04-12 09:08:58 -07:00
2017-02-18 16:39:27 +01:00
2015-12-22 15:15:34 -05:00
2016-12-10 19:07:22 +01:00
2017-03-22 12:04:16 +01:00
2017-03-22 12:04:13 +01:00
2017-02-14 15:22:52 -08:00