APPLIED: [SRU][B/linux][PATCH] tap: fix use-after-free

[Khaled Elmously]

On 2020-07-31 10:28:33 , Juerg Haefliger wrote:
> From: "Michael S. Tsirkin" <mst at redhat.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1889735
> 
> Lockless access to __ptr_ring_full is only legal if ring is
> never resized, otherwise it might cause use-after free errors.
> Simply drop the lockless test, we'll drop the packet
> a bit later when produce fails.
> 
> Fixes: 362899b8 ("macvtap: switch to use skb array")
> Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
> Signed-off-by: David S. Miller <davem at davemloft.net>
> 
> (backported from commit 88fae87327a2261cf8db078f6ce4e5a3e55b30b1)
> [juergh: __ptr_ring_full() -> __skb_array_full() due to lack of commit
>  5990a30510ed ("tun/tap: use ptr_ring instead of skb_array").]
> Signed-off-by: Juerg Haefliger <juergh at canonical.com>
> ---
>  drivers/net/tap.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/net/tap.c b/drivers/net/tap.c
> index afbe5bec2c33..f8b44d395c2f 100644
> --- a/drivers/net/tap.c
> +++ b/drivers/net/tap.c
> @@ -330,9 +330,6 @@ rx_handler_result_t tap_handle_frame(struct sk_buff **pskb)
>  	if (!q)
>  		return RX_HANDLER_PASS;
>  
> -	if (__skb_array_full(&q->skb_array))
> -		goto drop;
> -
>  	skb_push(skb, ETH_HLEN);
>  
>  	/* Apply the forward feature mask so that we perform segmentation
> -- 
> 2.25.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team