When rt_fill_info passes an skb to ipmr_get_route, it doesn't handle the case where ipmr_get_route frees the skb (it gets freed in ipmr_cache_unresolved). Instead, it bounces down to nlmsg_failure, where it calls skb_trim on the deallocated skb.
Spotted by Coverity's checker.
bugme-daemon@bugzilla.kernel.org wrote: > > http://bugzilla.kernel.org/show_bug.cgi?id=6186 > > Summary: net/ipv4/route.c: use after free in rt_fill_info > Kernel Version: 2.6.16-git > Status: NEW > Severity: normal > Owner: shemminger@osdl.org > Submitter: bos@serpentine.com > > > When rt_fill_info passes an skb to ipmr_get_route, it doesn't handle the case > where ipmr_get_route frees the skb (it gets freed in ipmr_cache_unresolved). > > Instead, it bounces down to nlmsg_failure, where it calls skb_trim on the > deallocated skb. > A coverity catch, I assume?
Reply-To: davem@davemloft.net From: Andrew Morton <akpm@osdl.org> Date: Tue, 7 Mar 2006 16:41:02 -0800 > bugme-daemon@bugzilla.kernel.org wrote: > > > > http://bugzilla.kernel.org/show_bug.cgi?id=6186 > > > > Summary: net/ipv4/route.c: use after free in rt_fill_info > > Kernel Version: 2.6.16-git > > Status: NEW > > Severity: normal > > Owner: shemminger@osdl.org > > Submitter: bos@serpentine.com > > > > > > When rt_fill_info passes an skb to ipmr_get_route, it doesn't handle the case > > where ipmr_get_route frees the skb (it gets freed in ipmr_cache_unresolved). > > > > Instead, it bounces down to nlmsg_failure, where it calls skb_trim on the > > deallocated skb. > > > > A coverity catch, I assume? In any case, this particular code can't work at all and it's been a known problem for at least 2 years but nobody has felt inspired to work on it. This ipmr_get_route() function is getting a netlink SKB to fill in the info, but if it can't find the cached entry it uses that SKB as a normal IPv4 packet to try and resolve a new cache entry totally clobbering the caller's state.
Created attachment 8609 [details] Possible patch to test Allocate a new skb to avoid the bug
Patch cleaned up and submitted