From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; dkim=none Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F016192 for ; Tue, 21 Nov 2023 04:38:40 -0800 (PST) Received: from dggpeml500026.china.huawei.com (unknown [172.30.72.56]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4SZP3H4pznz1P8jn; Tue, 21 Nov 2023 20:35:07 +0800 (CST) Received: from [10.174.178.66] (10.174.178.66) by dggpeml500026.china.huawei.com (7.185.36.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Tue, 21 Nov 2023 20:38:34 +0800 Message-ID: <9a221a65-71ae-2bca-e33c-f62c6b625461@huawei.com> Date: Tue, 21 Nov 2023 20:38:34 +0800 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.0.2 Subject: Re: [PATCH net] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet To: Hangbin Liu CC: , , , , , , , References: <20231121020558.240321-1-shaozhengchao@huawei.com> From: shaozhengchao In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.174.178.66] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpeml500026.china.huawei.com (7.185.36.106) X-CFilter-Loop: Reflected On 2023/11/21 10:56, Hangbin Liu wrote: > Hi Zhengchao, > On Tue, Nov 21, 2023 at 10:05:58AM +0800, Zhengchao Shao wrote: >> --- >> net/ipv4/igmp.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c >> index 76c3ea75b8dd..f217581904d6 100644 >> --- a/net/ipv4/igmp.c >> +++ b/net/ipv4/igmp.c >> @@ -1044,6 +1044,8 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb, >> for_each_pmc_rcu(in_dev, im) { >> int changed; >> >> + if (!netif_running(im->interface->dev)) >> + continue; > > I haven't checked this part for a long time. What's the difference of in_dev->dev > and im->interface->dev? I though they are the same, no? > > If they are the same, should we stop processing the query earlier? e.g. > Hi Hangbin: Yes, they are the same. > diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c > index 76c3ea75b8dd..f4e1d229c9aa 100644 > --- a/net/ipv4/igmp.c > +++ b/net/ipv4/igmp.c > @@ -1082,6 +1082,9 @@ int igmp_rcv(struct sk_buff *skb) > goto drop; > } > > + if (!netif_running(dev)) > + goto drop; > + > in_dev = __in_dev_get_rcu(dev); > if (!in_dev) > goto drop; > > > BTW, does IPv6 MLD has this issue? I will take a look at IPv6 MLD later. maybe tonight. Thank you. Zhengchao Shao > > Thanks > Hangbin >