lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: fix double-free and use-after free

Browse Source 
As suggested by Patrick McHardy, introduce a __krealloc() that doesn't
free the original buffer to fix a double-free and use-after-free bug
introduced by me in netfilter that uses RCU.

Reported-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Tested-by: Dieter Ries <clip2@gmx.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pekka Enberg
2008-07-26 17:49:33 -07:00
committed by David S. Miller
parent 3918fed5f3
commit 93bc4e89c2
3 changed files with 37 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/netfilter/nf_conntrack_extend.c
View File

@@ -95,7 +95,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
newlen = newoff + t->len;
rcu_read_unlock();
new = krealloc(ct->ext, newlen, gfp);
new = __krealloc(ct->ext, newlen, gfp);
if (!new)
return NULL;