|
 |
8538b1 |
From: Artem Savkov <asavkov@redhat.com>
|
|
|
8538b1 |
Subject: [RHEL-7.9 CVE-2021-3715 KPATCH] net_sched: cls_route: remove the right filter from hashtable
|
|
|
8538b1 |
Date: Mon, 30 Aug 2021 17:33:51 +0200
|
|
|
8538b1 |
|
|
|
8538b1 |
Kernels:
|
|
|
8538b1 |
3.10.0-1160.el7
|
|
|
8538b1 |
3.10.0-1160.2.1.el7
|
|
|
8538b1 |
3.10.0-1160.2.2.el7
|
|
|
8538b1 |
3.10.0-1160.6.1.el7
|
|
|
8538b1 |
3.10.0-1160.11.1.el7
|
|
|
8538b1 |
3.10.0-1160.15.2.el7
|
|
|
8538b1 |
3.10.0-1160.21.1.el7
|
|
|
8538b1 |
3.10.0-1160.24.1.el7
|
|
|
8538b1 |
3.10.0-1160.25.1.el7
|
|
|
8538b1 |
3.10.0-1160.31.1.el7
|
|
|
8538b1 |
3.10.0-1160.36.2.el7
|
|
|
8538b1 |
3.10.0-1160.41.1.el7
|
|
|
8538b1 |
|
|
|
8538b1 |
Changes since last build:
|
|
|
8538b1 |
arches: x86_64 ppc64le
|
|
|
8538b1 |
cls_route.o: changed function: route4_change
|
|
|
8538b1 |
---------------------------
|
|
|
8538b1 |
|
|
|
8538b1 |
Kernels:
|
|
|
8538b1 |
3.10.0-1160.el7
|
|
|
8538b1 |
3.10.0-1160.2.1.el7
|
|
|
8538b1 |
3.10.0-1160.2.2.el7
|
|
|
8538b1 |
3.10.0-1160.6.1.el7
|
|
|
8538b1 |
3.10.0-1160.11.1.el7
|
|
|
8538b1 |
3.10.0-1160.15.2.el7
|
|
|
8538b1 |
3.10.0-1160.21.1.el7
|
|
|
8538b1 |
3.10.0-1160.24.1.el7
|
|
|
8538b1 |
3.10.0-1160.25.1.el7
|
|
|
8538b1 |
3.10.0-1160.31.1.el7
|
|
|
8538b1 |
3.10.0-1160.36.2.el7
|
|
|
8538b1 |
|
|
|
8538b1 |
Modifications: none
|
|
|
8538b1 |
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/251
|
|
|
8538b1 |
|
|
|
8538b1 |
commit f4e1814eb56167451ddd819fccb951178f97660b
|
|
|
8538b1 |
Author: Ivan Vecera <ivecera@redhat.com>
|
|
|
8538b1 |
Date: Tue Aug 17 12:21:33 2021 +0200
|
|
|
8538b1 |
|
|
|
8538b1 |
net_sched: cls_route: remove the right filter from hashtable
|
|
|
8538b1 |
|
|
|
8538b1 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1992926
|
|
|
8538b1 |
|
|
|
8538b1 |
commit ef299cc3fa1a9e1288665a9fdc8bff55629fd359
|
|
|
8538b1 |
Author: Cong Wang <xiyou.wangcong@gmail.com>
|
|
|
8538b1 |
Date: Fri Mar 13 22:29:54 2020 -0700
|
|
|
8538b1 |
|
|
|
8538b1 |
net_sched: cls_route: remove the right filter from hashtable
|
|
|
8538b1 |
|
|
|
8538b1 |
route4_change() allocates a new filter and copies values from
|
|
|
8538b1 |
the old one. After the new filter is inserted into the hash
|
|
|
8538b1 |
table, the old filter should be removed and freed, as the final
|
|
|
8538b1 |
step of the update.
|
|
|
8538b1 |
|
|
|
8538b1 |
However, the current code mistakenly removes the new one. This
|
|
|
8538b1 |
looks apparently wrong to me, and it causes double "free" and
|
|
|
8538b1 |
use-after-free too, as reported by syzbot.
|
|
|
8538b1 |
|
|
|
8538b1 |
Reported-and-tested-by: syzbot+f9b32aaacd60305d9687@syzkaller.appspotmail.com
|
|
|
8538b1 |
Reported-and-tested-by: syzbot+2f8c233f131943d6056d@syzkaller.appspotmail.com
|
|
|
8538b1 |
Reported-and-tested-by: syzbot+9c2df9fd5e9445b74e01@syzkaller.appspotmail.com
|
|
|
8538b1 |
Fixes: 1109c00547fc ("net: sched: RCU cls_route")
|
|
|
8538b1 |
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
|
|
|
8538b1 |
Cc: Jiri Pirko <jiri@resnulli.us>
|
|
|
8538b1 |
Cc: John Fastabend <john.fastabend@gmail.com>
|
|
|
8538b1 |
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
|
|
|
8538b1 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
8538b1 |
|
|
|
8538b1 |
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
|
|
|
8538b1 |
|
|
|
8538b1 |
Signed-off-by: Artem Savkov <asavkov@redhat.com>
|
|
|
8538b1 |
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
|
|
|
8538b1 |
---
|
|
|
8538b1 |
net/sched/cls_route.c | 4 ++--
|
|
|
8538b1 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
8538b1 |
|
|
|
8538b1 |
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
|
|
|
8538b1 |
index 7bd464e8d084..2fed29fa504e 100644
|
|
|
8538b1 |
--- a/net/sched/cls_route.c
|
|
|
8538b1 |
+++ b/net/sched/cls_route.c
|
|
|
8538b1 |
@@ -534,8 +534,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
|
|
|
8538b1 |
fp = &b->ht[h];
|
|
|
8538b1 |
for (pfp = rtnl_dereference(*fp); pfp;
|
|
|
8538b1 |
fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
|
|
|
8538b1 |
- if (pfp == f) {
|
|
|
8538b1 |
- *fp = f->next;
|
|
|
8538b1 |
+ if (pfp == fold) {
|
|
|
8538b1 |
+ rcu_assign_pointer(*fp, fold->next);
|
|
|
8538b1 |
break;
|
|
|
8538b1 |
}
|
|
|
8538b1 |
}
|
|
|
8538b1 |
--
|
|
|
8538b1 |
2.31.1
|
|
|
8538b1 |
|
|
|
8538b1 |
|