aadb22ba2f
In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
65 lines
2.0 KiB
C
65 lines
2.0 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef DRBD_STATE_CHANGE_H
|
|
#define DRBD_STATE_CHANGE_H
|
|
|
|
struct drbd_resource_state_change {
|
|
struct drbd_resource *resource;
|
|
enum drbd_role role[2];
|
|
bool susp[2];
|
|
bool susp_nod[2];
|
|
bool susp_fen[2];
|
|
};
|
|
|
|
struct drbd_device_state_change {
|
|
struct drbd_device *device;
|
|
enum drbd_disk_state disk_state[2];
|
|
};
|
|
|
|
struct drbd_connection_state_change {
|
|
struct drbd_connection *connection;
|
|
enum drbd_conns cstate[2]; /* drbd9: enum drbd_conn_state */
|
|
enum drbd_role peer_role[2];
|
|
};
|
|
|
|
struct drbd_peer_device_state_change {
|
|
struct drbd_peer_device *peer_device;
|
|
enum drbd_disk_state disk_state[2];
|
|
enum drbd_conns repl_state[2]; /* drbd9: enum drbd_repl_state */
|
|
bool resync_susp_user[2];
|
|
bool resync_susp_peer[2];
|
|
bool resync_susp_dependency[2];
|
|
};
|
|
|
|
struct drbd_state_change {
|
|
struct list_head list;
|
|
unsigned int n_devices;
|
|
unsigned int n_connections;
|
|
struct drbd_resource_state_change resource[1];
|
|
struct drbd_device_state_change *devices;
|
|
struct drbd_connection_state_change *connections;
|
|
struct drbd_peer_device_state_change *peer_devices;
|
|
};
|
|
|
|
extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_t);
|
|
extern void copy_old_to_new_state_change(struct drbd_state_change *);
|
|
extern void forget_state_change(struct drbd_state_change *);
|
|
|
|
extern int notify_resource_state_change(struct sk_buff *,
|
|
unsigned int,
|
|
struct drbd_resource_state_change *,
|
|
enum drbd_notification_type type);
|
|
extern int notify_connection_state_change(struct sk_buff *,
|
|
unsigned int,
|
|
struct drbd_connection_state_change *,
|
|
enum drbd_notification_type type);
|
|
extern int notify_device_state_change(struct sk_buff *,
|
|
unsigned int,
|
|
struct drbd_device_state_change *,
|
|
enum drbd_notification_type type);
|
|
extern int notify_peer_device_state_change(struct sk_buff *,
|
|
unsigned int,
|
|
struct drbd_peer_device_state_change *,
|
|
enum drbd_notification_type type);
|
|
|
|
#endif /* DRBD_STATE_CHANGE_H */
|