linux-kernel - Re: [PATCH 0/7] net, netfilter refcounter conversions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Mar 2017 12:50:41 +0100
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     "Reshetova, Elena" <elena.reshetova@...el.com>
Cc:     "netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kadlec@...ckhole.kfki.hu" <kadlec@...ckhole.kfki.hu>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>
Subject: Re: [PATCH 0/7] net, netfilter refcounter conversions

On Thu, Mar 16, 2017 at 07:52:19AM +0000, Reshetova, Elena wrote:
> 
> > On Wed, Mar 15, 2017 at 01:10:38PM +0200, Elena Reshetova wrote:
> > > This series, for the netfilter subsystem, replaces atomic_t reference
> > > counters with the new refcount_t type and API (see include/linux/refcount.h).
> > > By doing this we prevent intentional or accidental
> > > underflows or overflows that can led to use-after-free vulnerabilities.
> > >
> > > Please take the series to your tree if there are no run-time issues.
> > 
> > Could you collapse all of your patches into one single? They are all
> > part of the same logical change to me.
> > 
> > >  21 files changed, 85 insertions(+), 75 deletions(-)
> > 
> > The diffstat is small enough to do what I'm asking.
> 
> Sure. The reason why they are separated is that it is easier to
> review them this way IMO and find mistakes (I found many after I
> split all networking patches into one per variable).  But I guess
> for merge, it is easier to have them collapsed, so I am going to
> send you a new version shortly.

In my particular case, collapsing them is good so the Netfilter batch
I pass up to David becomes smaller. Thanks!