mirror of
https://github.com/torvalds/linux
synced 2024-09-22 20:37:18 +00:00
udp: fix possible user after free in error handler
Similar to the previous commit, this addresses the same issue for
ipv4: use a single fetch operation and use the correct rcu
annotation.
Fixes: e7cc082455
("udp: Support for error handlers of tunnels with arbitrary destination port")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
424a7cd078
commit
92b9536423
|
@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info)
|
||||||
|
|
||||||
for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
|
for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
|
||||||
int (*handler)(struct sk_buff *skb, u32 info);
|
int (*handler)(struct sk_buff *skb, u32 info);
|
||||||
|
const struct ip_tunnel_encap_ops *encap;
|
||||||
|
|
||||||
if (!iptun_encaps[i])
|
encap = rcu_dereference(iptun_encaps[i]);
|
||||||
|
if (!encap)
|
||||||
continue;
|
continue;
|
||||||
handler = rcu_dereference(iptun_encaps[i]->err_handler);
|
handler = encap->err_handler;
|
||||||
if (handler && !handler(skb, info))
|
if (handler && !handler(skb, info))
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue