diff options
| author | Jeongjun Park <[email protected]> | 2024-08-22 18:11:09 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2024-08-29 00:07:42 +0000 |
| commit | 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 (patch) | |
| tree | 5331c970f54958f43c867cbf0bbdba8a712420a6 /net/ipv4/tcp_ipv4.c | |
| parent | Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/... (diff) | |
| download | kernel-0fa5e94a1811d68fbffa0725efe6d4ca62c03d12.tar.gz kernel-0fa5e94a1811d68fbffa0725efe6d4ca62c03d12.zip | |
net/xen-netback: prevent UAF in xenvif_flush_hash()
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash,
kfree_rcu does not exist inside the rcu read critical section, so if
kfree_rcu is called when the rcu grace period ends during the iteration,
UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to list_for_each_entry_safe.
Signed-off-by: Jeongjun Park <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
0 files changed, 0 insertions, 0 deletions