Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Cong Wang b6ec053486 mqueue: fix a use-after-free in sys_mq_notify() ... commit f991af3daa upstream. The retry logic for netlink_attachskb() inside sys_mq_notify() is nasty and vulnerable: 1) The sock refcnt is already released when retry is needed 2) The fd is controllable by user-space because we already release the file refcnt so we when retry but the fd has been just closed by user-space during this small window, we end up calling netlink_detachskb() on the error path which releases the sock again, later when the user-space closes this socket a use-after-free could be triggered. Setting 'sock' to NULL here should be sufficient to fix it. Reported-by: GeneBlue <geneblue.mail@gmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2017-08-26 02:14:49 +01:00
..
compat.c	ipc, kernel: use Linux headers	2014-06-06 16:08:14 -07:00
compat_mq.c	ipc, kernel: use Linux headers	2014-06-06 16:08:14 -07:00
ipc_sysctl.c	ipc: always handle a new value of auto_msgmni	2014-11-27 11:22:09 +00:00
ipcns_notifier.c	ipc: do not use a negative value to re-enable msgmni automatic recomputing	2008-07-25 10:53:42 -07:00
Makefile	Add generic sys_ipc wrapper	2010-03-12 15:52:32 -08:00
mq_sysctl.c	ipc: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
mqueue.c	mqueue: fix a use-after-free in sys_mq_notify()	2017-08-26 02:14:49 +01:00
msg.c	ipc: remove use of seq_printf return value	2017-02-23 03:54:11 +00:00
msgutil.c	ipc, msg: fix message length check for negative values	2013-11-13 12:09:36 +09:00
namespace.c	ipc: drop ipc_lock_by_ptr	2013-09-11 15:59:44 -07:00
sem.c	ipc/sem.c: fix complex_count vs. simple op race	2017-02-23 03:54:12 +00:00
shm.c	ipc/shm: Fix shmat mmap nil-page protection	2017-03-16 02:27:27 +00:00
syscall.c	get rid of union semop in sys_semctl(2) arguments	2013-03-05 15:14:16 -05:00
util.c	ipc: remove use of seq_printf return value	2017-02-23 03:54:11 +00:00
util.h	ipc, kernel: clear whitespace	2014-06-06 16:08:14 -07:00