|
 |
7e752c |
From e7c11266309ffa65143455ceefc17fe92d93511c Mon Sep 17 00:00:00 2001
|
|
|
7e752c |
From: Phil Sutter <psutter@redhat.com>
|
|
|
7e752c |
Date: Thu, 25 Oct 2018 12:24:30 +0200
|
|
|
7e752c |
Subject: [PATCH] libnetlink: fix use-after-free of message buf
|
|
|
7e752c |
|
|
|
7e752c |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1602555
|
|
|
7e752c |
Upstream Status: iproute2.git commit 8c50b728b226f
|
|
|
7e752c |
|
|
|
7e752c |
commit 8c50b728b226f6254251282697ce38a72639a6fc
|
|
|
7e752c |
Author: Vlad Buslov <vladbu@mellanox.com>
|
|
|
7e752c |
Date: Mon Oct 8 23:52:26 2018 +0300
|
|
|
7e752c |
|
|
|
7e752c |
libnetlink: fix use-after-free of message buf
|
|
|
7e752c |
|
|
|
7e752c |
In __rtnl_talk_iov() main loop, err is a pointer to memory in dynamically
|
|
|
7e752c |
allocated 'buf' that is used to store netlink messages. If netlink message
|
|
|
7e752c |
is an error message, buf is deallocated before returning with error code.
|
|
|
7e752c |
However, on return err->error code is checked one more time to generate
|
|
|
7e752c |
return value, after memory which err points to has already been
|
|
|
7e752c |
freed. Save error code in temporary variable and use the variable to
|
|
|
7e752c |
generate return value.
|
|
|
7e752c |
|
|
|
7e752c |
Fixes: c60389e4f9ea ("libnetlink: fix leak and using unused memory on error")
|
|
|
7e752c |
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
|
|
|
7e752c |
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|
|
7e752c |
---
|
|
|
7e752c |
lib/libnetlink.c | 3 ++-
|
|
|
7e752c |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
7e752c |
|
|
|
7e752c |
diff --git a/lib/libnetlink.c b/lib/libnetlink.c
|
|
|
7e752c |
index f18dcea..a9932d4 100644
|
|
|
7e752c |
--- a/lib/libnetlink.c
|
|
|
7e752c |
+++ b/lib/libnetlink.c
|
|
|
7e752c |
@@ -656,6 +656,7 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
|
|
|
7e752c |
|
|
|
7e752c |
if (h->nlmsg_type == NLMSG_ERROR) {
|
|
|
7e752c |
struct nlmsgerr *err = (struct nlmsgerr *)NLMSG_DATA(h);
|
|
|
7e752c |
+ int error = err->error;
|
|
|
7e752c |
|
|
|
7e752c |
if (l < sizeof(struct nlmsgerr)) {
|
|
|
7e752c |
fprintf(stderr, "ERROR truncated\n");
|
|
|
7e752c |
@@ -679,7 +680,7 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
|
|
|
7e752c |
else
|
|
|
7e752c |
free(buf);
|
|
|
7e752c |
|
|
|
7e752c |
- return err->error ? -i : 0;
|
|
|
7e752c |
+ return error ? -i : 0;
|
|
|
7e752c |
}
|
|
|
7e752c |
|
|
|
7e752c |
if (answer) {
|
|
|
7e752c |
--
|
|
|
7e752c |
1.8.3.1
|
|
|
7e752c |
|