We founf a possible UAF if rmmod pe_sid or schedule,
when packages in hook and get pe or sched.
Signed-off-by: sunsuwan <sunsuwan3@xxxxxxxxxx>
Signed-off-by: chenzhen <chenzhen126@xxxxxxxxxx>
---
net/netfilter/ipvs/ip_vs_core.c | 6 ++++++
net/netfilter/ipvs/ip_vs_ctl.c | 3 +++
net/netfilter/ipvs/ip_vs_dh.c | 2 ++
3 files changed, 11 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 51ad557a525b..d289f184d5c1 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -235,7 +235,9 @@ ip_vs_conn_fill_param_persist(const struct ip_vs_service
*svc,
{
ip_vs_conn_fill_param(svc->ipvs, svc->af, protocol, caddr, cport, vaddr,
vport, p);
+ rcu_read_lock();
p->pe = rcu_dereference(svc->pe);
+ rcu_read_unlock();
if (p->pe && p->pe->fill_param)
return p->pe->fill_param(p, skb);
@@ -346,7 +348,9 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
* template is not available.
* return *ignored=0 i.e. ICMP and NF_DROP
*/
+ rcu_read_lock();
sched = rcu_dereference(svc->scheduler);
+ rcu_read_unlock();
if (sched) {
/* read svc->sched_data after svc->scheduler */
smp_rmb();
@@ -521,7 +525,9 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff
*skb,
return NULL;
}
+ rcu_read_lock();
sched = rcu_dereference(svc->scheduler);
+ rcu_read_unlock();
if (sched) {
/* read svc->sched_data after svc->scheduler */
smp_rmb();
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index efab2b06d373..91e568028001 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -580,6 +580,7 @@ bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int
af, __u16 protocol,
/* Check for "full" addressed entries */
hash = ip_vs_rs_hashkey(af, daddr, dport);
+ rcu_read_lock();
hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
if (dest->port == dport &&
dest->af == af &&
@@ -587,9 +588,11 @@ bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int
af, __u16 protocol,
(dest->protocol == protocol || dest->vfwmark) &&
IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_MASQ) {
/* HIT */
+ rcu_read_unlock();
return true;
}
}
+ rcu_read_unlock();
return false;
}
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index 5e6ec32aff2b..3e4b9607172b 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -219,7 +219,9 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct
sk_buff *skb,
IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
s = (struct ip_vs_dh_state *) svc->sched_data;
+ rcu_read_lock();
dest = ip_vs_dh_get(svc->af, s, &iph->daddr);
+ rcu_read_unlock();
if (!dest
|| !(dest->flags & IP_VS_DEST_F_AVAILABLE)
|| atomic_read(&dest->weight) <= 0
--
2.30.0
|