未验证 提交 876a3b2f 编写于 作者: O openeuler-ci-bot 提交者: Gitee

!1775 [sync] PR-1729: fix CVE-2023-4128 in OLK510

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1729 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RHW5R5YZ4QMNY3YD7F65XJ6AFMBVMCOF/ 
fix CVE-2023-4128 in OLK510

valis (3):
  net/sched: cls_u32: No longer copy tcf_result on update to avoid
    use-after-free
  net/sched: cls_fw: No longer copy tcf_result on update to avoid
    use-after-free
  net/sched: cls_route: No longer copy tcf_result on update to avoid
    use-after-free


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I7SAP1 
 
Link:https://gitee.com/openeuler/kernel/pulls/1775 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com> 
...@@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb, ...@@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
return -ENOBUFS; return -ENOBUFS;
fnew->id = f->id; fnew->id = f->id;
fnew->res = f->res;
fnew->ifindex = f->ifindex; fnew->ifindex = f->ifindex;
fnew->tp = f->tp; fnew->tp = f->tp;
......
...@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, ...@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
if (fold) { if (fold) {
f->id = fold->id; f->id = fold->id;
f->iif = fold->iif; f->iif = fold->iif;
f->res = fold->res;
f->handle = fold->handle; f->handle = fold->handle;
f->tp = fold->tp; f->tp = fold->tp;
......
...@@ -812,7 +812,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, ...@@ -812,7 +812,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
new->ifindex = n->ifindex; new->ifindex = n->ifindex;
new->fshift = n->fshift; new->fshift = n->fshift;
new->res = n->res;
new->flags = n->flags; new->flags = n->flags;
RCU_INIT_POINTER(new->ht_down, ht); RCU_INIT_POINTER(new->ht_down, ht);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册