BACKPORT: ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree [chromiumos/third_party/kernel : chromeos-4.14]

11 views

Skip to first unread message

ChromeOS bot (Gerrit)

unread,

Feb 6, 2018, 2:07:24 AM2/6/18

to Guenter Roeck, Kevin Cernekee, Bernie Thompson, Zubin Mithra

ChromeOS bot merged this change.

BACKPORT: ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree

When multiple threads is trying to tag/delete the same socket at the
same time, there is a chance the tag_ref_entry of the target socket to
be null before the uid_tag_data entry is freed. It is caused by the
ctrl_cmd_tag function where it doesn't correctly grab the spinlocks
when tagging a socket.

Signed-off-by: Chenbo Feng <fe...@google.com>
Bug: 65853158

BUG=b:72955934
TEST=Build and boot

Change-Id: Ia184ee6d0867c7ef363363fbe9650e2915f212a8
Signed-off-by: Guenter Roeck <gro...@chromium.org>
(cherry picked from commit 95b46d44c643a67e9659c13c6892b1653336de86
 https://partner-android.googlesource.com/kernel/private/msm-google android-msm-wahoo-4.4)
Reviewed-on: https://chromium-review.googlesource.com/902942
Reviewed-by: Bernie Thompson <bhtho...@chromium.org>
Reviewed-by: Kevin Cernekee <cern...@chromium.org>
---
M net/netfilter/xt_qtaguid.c
1 file changed, 11 insertions(+), 9 deletions(-)

To view, visit change 902942. To unsubscribe, or for help writing mail filters, visit settings.

Reply all

Reply to author

Forward

0 new messages