kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/arch/um
History
Michael Bommarito a7bc015bb7 um: vector: fix use-after-free in vector_mmsg_rx() 
commit af421e9aed upstream.

When vector_mmsg_rx() discards a packet whose overlay header fails
verify_header(), it frees the skb and continues the loop:

	if (header_check < 0) {
		dev_kfree_skb_irq(skb);
		vp->estats.rx_encaps_errors++;
		continue;
	}

The normal and short-packet paths fall through to the bottom of the
loop body, which clears the consumed slot and advances the cursors:

	(*skbuff_vector) = NULL;
	mmsg_vector++;
	skbuff_vector++;

The verify_header() < 0 path skips that via continue, so the freed skb
is left in skbuff_vector[] and the cursors do not advance. The next
iteration reads the same slot, gets the freed skb, and frees it again,
producing a refcount underflow / use-after-free in the RX path.

Discard the slot the same way the other paths do before continuing.

Only transports whose verify_header() can return negative are affected:
GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not),
so any peer on such a transport can trigger it without authentication.

Fixes: 49da7e64f3 ("High Performance UML Vector Network Driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-19 17:14:10 +02:00
..
configs um: Fix hostaudio build errors 2023-09-19 12:22:49 +02:00
drivers um: vector: fix use-after-free in vector_mmsg_rx() 2026-08-19 17:14:10 +02:00
include sched: Add wrapper for get_wchan() to keep task blocked 2025-08-28 16:24:03 +02:00
kernel sched: Add wrapper for get_wchan() to keep task blocked 2025-08-28 16:24:03 +02:00
os-Linux um: time-travel: fix signal blocking race/hang 2024-08-19 05:45:23 +02:00
scripts License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
.gitignore um: gitignore: Add kernel/capflags.c 2022-01-27 11:05:34 +01:00
Kbuild kbuild: require all architectures to have arch/$(SRCARCH)/Kbuild 2021-05-26 23:10:37 +09:00
Kconfig um/cpu: Switch to arch_cpu_finalize_init() 2023-08-08 19:58:31 +02:00
Kconfig.debug um: Disable CONFIG_GCOV with MODULES 2021-04-15 23:10:33 +02:00
Makefile um: let 'make clean' properly clean underlying SUBARCH as well 2025-06-04 14:38:08 +02:00
Makefile-os-Linux x86, um: get rid of arch/um/os symlink 2008-10-22 22:55:22 -07:00
Makefile-skas [PATCH] uml makefiles sanitized 2005-09-29 08:46:26 -07:00