Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Chun-Yi Lee 07b418d50c aoe: fix the potential use-after-free problem in more places ... commit 6d6e54fc71 upstream. For fixing CVE-2023-6270, f98364e926 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue. Cc: stable@vger.kernel.org Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6270 Fixes: f98364e926 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") Reported-by: Nicolai Stange <nstange@suse.com> Signed-off-by: Chun-Yi Lee <jlee@suse.com> Link: https://lore.kernel.org/stable/20240624064418.27043-1-jlee%40suse.com Link: https://lore.kernel.org/r/20241002035458.24401-1-jlee@suse.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2024-10-17 15:11:39 +02:00
..
aoe.h	aoe: replace ->special use with private data in the request	2018-11-10 08:03:49 -07:00
aoeblk.c	aoe: use blk_mq_alloc_disk and blk_cleanup_disk	2021-06-11 11:53:03 -06:00
aoechr.c	aoe: remove unnecessary oom message	2021-06-09 09:41:48 -06:00
aoecmd.c	aoe: fix the potential use-after-free problem in more places	2024-10-17 15:11:39 +02:00
aoedev.c	aoe: use blk_mq_alloc_disk and blk_cleanup_disk	2021-06-11 11:53:03 -06:00
aoemain.c	aoe: add __exit annotation	2018-12-16 09:01:38 -07:00
aoenet.c	aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts	2024-03-26 18:21:15 -04:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00