tree bf660ce80966193deef4105ed213dfdf6c4464e7
parent 38769a817486deab62178507564e81404d9fbcd0
author Lee Jones <lee@kernel.org> 1686209343 +0100
committer Anil Altinay <aaltinay@google.com> 1689275941 +0000

net/sched: cls_u32: Fix reference counter leak leading to overflow

[ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ]

In the event of a failure in tcf_change_indev(), u32_set_parms() will
immediately return without decrementing the recently incremented
reference counter.  If this happens enough times, the counter will
rollover and the reference freed, leading to a double free which can be
used to do 'bad things'.

In order to prevent this, move the point of possible failure above the
point where the reference counter is incremented.  Also save any
meaningful return values to be applied to the return data at the
appropriate point in time.

This issue was caught with KASAN.

BUG=b/290994864
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2023-3609 in the Linux kernel.

cos-patch: security-moderate
Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Change-Id: Ie05ce54039ab8257250d9714b0c858bc12dd0c4e
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/51976
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: He Gao <hegao@google.com>