diff options
| author | Masahiro Fujiwara <fujiwara.masahiro@gmail.com> | 2020-10-27 20:48:46 +0900 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-10-29 09:43:21 -0700 |
| commit | 51467431200b91682b89d31317e35dcbca1469ce (patch) | |
| tree | 4d1576d6cd250eebf1dc9ea072a25f4ddbf0cfc0 /net | |
| parent | d6535dca28859d8d9ef80894eb287b2ac35a32e8 (diff) | |
| download | linux-51467431200b91682b89d31317e35dcbca1469ce.tar.bz2 | |
gtp: fix an use-before-init in gtp_newlink()
*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.
RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
<IRQ>
gtp_encap_recv+0xc2/0x2e0 [gtp]
? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
udp_queue_rcv_one_skb+0x1fe/0x530
udp_queue_rcv_skb+0x40/0x1b0
udp_unicast_rcv_skb.isra.0+0x78/0x90
__udp4_lib_rcv+0x5af/0xc70
udp_rcv+0x1a/0x20
ip_protocol_deliver_rcu+0xc5/0x1b0
ip_local_deliver_finish+0x48/0x50
ip_local_deliver+0xe5/0xf0
? ip_protocol_deliver_rcu+0x1b0/0x1b0
gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.
Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
Link: https://lore.kernel.org/r/20201027114846.3924-1-fujiwara.masahiro@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions