]> git.ipfire.org Git - thirdparty/ipset.git/commit
netfilter: ipset: fix suspicious RCU usage in find_set_and_id
authorJozsef Kadlecsik <kadlec@netfilter.org>
Sat, 25 Jan 2020 17:55:06 +0000 (18:55 +0100)
committerJozsef Kadlecsik <kadlec@netfilter.org>
Sun, 26 Jan 2020 10:57:57 +0000 (11:57 +0100)
commit7725bf5ba041b56a78fb2283b317cfa098e94801
tree3d5b09d1a71654cff6448c76de3b99c3c377f16b
parent3f685a1f904daf5fe29adcabf9474c1c35f85db1
netfilter: ipset: fix suspicious RCU usage in find_set_and_id

find_set_and_id() is called when the NFNL_SUBSYS_IPSET mutex is held.
However, in the error path there can be a follow-up recvmsg() without
the mutex held. Use the start() function of struct netlink_dump_control
instead of dump() to verify and report if the specified set does not
exist.

Thanks to Pablo Neira Ayuso for helping me to understand the subleties
of the netlink protocol.

Reported-by: syzbot+fc69d7cb21258ab4ae4d@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
kernel/net/netfilter/ipset/ip_set_core.c