summaryrefslogtreecommitdiff
path: root/net/irda
diff options
context:
space:
mode:
authorTyler Hicks <tyhicks@canonical.com>2018-09-04 18:24:05 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-09-15 10:43:01 +0300
commit18d94895f505d6eef2da8868e87a403cde1d9ef0 (patch)
tree0ebd14b460a10efd6844caed3a60ddc27bfbf39c /net/irda
parentce54bf4aec595c479b462180d682783b3776fb80 (diff)
downloadlinux-18d94895f505d6eef2da8868e87a403cde1d9ef0.tar.xz
irda: Only insert new objects into the global database via setsockopt
The irda_setsockopt() function conditionally allocates memory for a new self->ias_object or, in some cases, reuses the existing self->ias_object. Existing objects were incorrectly reinserted into the LM_IAS database which corrupted the doubly linked list used for the hashbin implementation of the LM_IAS database. When combined with a memory leak in irda_bind(), this issue could be leveraged to create a use-after-free vulnerability in the hashbin list. This patch fixes the issue by only inserting newly allocated objects into the database. CVE-2018-6555 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Stefan Bader <stefan.bader@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/irda')
-rw-r--r--net/irda/af_irda.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index b85fa22806f6..0a78f17006a4 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2023,7 +2023,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
err = -EINVAL;
goto out;
}
- irias_insert_object(ias_obj);
+
+ /* Only insert newly allocated objects */
+ if (free_ias)
+ irias_insert_object(ias_obj);
+
kfree(ias_opt);
break;
case IRLMP_IAS_DEL: