]> git.proxmox.com Git - mirror_iproute2.git/commit
ipnetns: use-after-free problem in get_netnsid_from_name func
authorZhiqiang Liu <liuzhiqiang26@huawei.com>
Sun, 5 May 2019 01:59:51 +0000 (09:59 +0800)
committerStephen Hemminger <stephen@networkplumber.org>
Mon, 6 May 2019 15:36:18 +0000 (08:36 -0700)
commit9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10
treef654041f310d785406791ff4402dd3ec5f4207a2
parente73306048f798ec6f6265cb6e6fcaf4543cddba6
ipnetns: use-after-free problem in get_netnsid_from_name func

Follow the following steps:
 # ip netns add net1
 # export MALLOC_MMAP_THRESHOLD_=0
 # ip netns list
then Segmentation fault (core dumped) will occur.

In get_netnsid_from_name func, answer is freed before
rta_getattr_u32(tb[NETNSA_NSID]), where tb[] refers to answer`s
content. If we set MALLOC_MMAP_THRESHOLD_=0, mmap will be adoped to
malloc memory, which will be freed immediately after calling free
func.  So reading tb[NETNSA_NSID] will access the released memory
after free(answer).

Here, we will call get_netnsid_from_name(tb[NETNSA_NSID]) before free(answer).

Fixes: 86bf43c7c2f ("lib/libnetlink: update rtnl_talk to support malloc buff at run time")
Reported-by: Huiying Kou <kouhuiying@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
ip/ipnetns.c