linux-kernel - Re: [PATCH 1/1] ax25: Fix segfault when receiving an iframe with net2kiss loaded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 02 Dec 2016 11:05:10 -0500 (EST)
From:   David Miller <davem@...hat.com>
To:     basil@...abunga.com
Cc:     jreuter@...na.de, ralf@...ux-mips.org, linux-hams@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org, ed@...kers.io, mcdermj@...otropic.com
Subject: Re: [PATCH 1/1] ax25: Fix segfault when receiving an iframe with
 net2kiss loaded

From: Basil Gunn <basil@...abunga.com>
Date: Wed, 30 Nov 2016 11:15:25 -0800

> AX.25 uses sock_queue_rcv_skb() to queue an iframe received packet.
> This routine writes NULL to the socket buffer device structure
> pointer. The socket buffer is subsequently serviced by
> __netif_receiv_skb_core() which dereferences the device structure
> pointer & segfaults.
> 
> The fix puts the ax25 device structure pointer back in the socket
> buffer struct after sock_queue_rcv_skb() is called.

You cannot do this.

We have no reference count held on the device object, therefore once
access to this SKB leaves the receive packet processing path and thus
the RCU protected region, we must set skb->dev to NULL.

Queueing the SKB to the socket causes the SKB to leave the receive
processing path.

You will have to find another way to propagate this device pointer
to the code that needs it.