Blame SOURCES/0028-libnetlink-fix-use-after-free-of-message-buf.patch

930fb9
From e7c11266309ffa65143455ceefc17fe92d93511c Mon Sep 17 00:00:00 2001
930fb9
From: Phil Sutter <psutter@redhat.com>
930fb9
Date: Thu, 25 Oct 2018 12:24:30 +0200
930fb9
Subject: [PATCH] libnetlink: fix use-after-free of message buf
930fb9
930fb9
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1602555
930fb9
Upstream Status: iproute2.git commit 8c50b728b226f
930fb9
930fb9
commit 8c50b728b226f6254251282697ce38a72639a6fc
930fb9
Author: Vlad Buslov <vladbu@mellanox.com>
930fb9
Date:   Mon Oct 8 23:52:26 2018 +0300
930fb9
930fb9
    libnetlink: fix use-after-free of message buf
930fb9
930fb9
    In __rtnl_talk_iov() main loop, err is a pointer to memory in dynamically
930fb9
    allocated 'buf' that is used to store netlink messages. If netlink message
930fb9
    is an error message, buf is deallocated before returning with error code.
930fb9
    However, on return err->error code is checked one more time to generate
930fb9
    return value, after memory which err points to has already been
930fb9
    freed. Save error code in temporary variable and use the variable to
930fb9
    generate return value.
930fb9
930fb9
    Fixes: c60389e4f9ea ("libnetlink: fix leak and using unused memory on error")
930fb9
    Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
930fb9
    Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
930fb9
---
930fb9
 lib/libnetlink.c | 3 ++-
930fb9
 1 file changed, 2 insertions(+), 1 deletion(-)
930fb9
930fb9
diff --git a/lib/libnetlink.c b/lib/libnetlink.c
930fb9
index f18dcea..a9932d4 100644
930fb9
--- a/lib/libnetlink.c
930fb9
+++ b/lib/libnetlink.c
930fb9
@@ -656,6 +656,7 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
930fb9
 
930fb9
 			if (h->nlmsg_type == NLMSG_ERROR) {
930fb9
 				struct nlmsgerr *err = (struct nlmsgerr *)NLMSG_DATA(h);
930fb9
+				int error = err->error;
930fb9
 
930fb9
 				if (l < sizeof(struct nlmsgerr)) {
930fb9
 					fprintf(stderr, "ERROR truncated\n");
930fb9
@@ -679,7 +680,7 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
930fb9
 				else
930fb9
 					free(buf);
930fb9
 
930fb9
-				return err->error ? -i : 0;
930fb9
+				return error ? -i : 0;
930fb9
 			}
930fb9
 
930fb9
 			if (answer) {
930fb9
-- 
930fb9
1.8.3.1
930fb9