Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92b95364 authored by Paolo Abeni's avatar Paolo Abeni Committed by David S. Miller
Browse files

udp: fix possible user after free in error handler 



Similar to the previous commit, this addresses the same issue for
ipv4: use a single fetch operation and use the correct rcu
annotation.

Fixes: e7cc0824 ("udp: Support for error handlers of tunnels with arbitrary destination port")
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Acked-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 424a7cd0

net/ipv4/udp.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info) 




	for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {

	for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {

		int (*handler)(struct sk_buff *skb, u32 info);

		int (*handler)(struct sk_buff *skb, u32 info);

		const struct ip_tunnel_encap_ops *encap;





		if (!iptun_encaps[i])

		encap = rcu_dereference(iptun_encaps[i]);

		if (!encap)

			continue;

			continue;

		handler = rcu_dereference(iptun_encaps[i]->err_handler);

		handler = encap->err_handler;

		if (handler && !handler(skb, info))

		if (handler && !handler(skb, info))

			return 0;

			return 0;

	}

	}