Re: [PATCH v2] net: ipv6: fix use-after-free Read in __xfrm6_tunnel_spi_lookup
flat view
From: Cong Wang <hidden>
Date: 2020-07-26 05:35:25
Also in:
linux-kernel-mentees, lkml
On Sat, Jul 25, 2020 at 8:09 PM B K Karthik [off-list ref] wrote:
quoted hunk ↗ jump to hunk
@@ -103,10 +103,10 @@ static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi) { struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net); struct xfrm6_tunnel_spi *x6spi; - int index = xfrm6_tunnel_spi_hash_byspi(spi); + int index = xfrm6_tunnel_spi_hash_byaddr((const xfrm_address_t *)spi); hlist_for_each_entry(x6spi, - &xfrm6_tn->spi_byspi[index], + &xfrm6_tn->spi_byaddr[index], list_byspi) { if (x6spi->spi == spi)
How did you convince yourself this is correct? This lookup is still using spi. :) More importantly, can you explain how UAF happens? Apparently the syzbot stack traces you quote make no sense at all. I also looked at other similar reports, none of them makes sense to me. Thanks.