netdev - Re: [PATCH 0/4] Fix race between sk_filter reassign and sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 17 Oct 2007 21:23:02 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	xemul@...nvz.org
Cc:	netdev@...r.kernel.org, devel@...nvz.org
Subject: Re: [PATCH 0/4] Fix race between sk_filter reassign and sk_clone()

From: Pavel Emelyanov <xemul@...nvz.org>
Date: Wed, 17 Oct 2007 13:45:54 +0400

> The race can result in that some sock will get an sk_filter
> pointer set to kfree-d memory. Look
> 
> CPU1:                            CPU2:
> sk_clone():                      sk_attach_filter():
>   new_sk = sk_alloc(...);
>   sock_copy(new_sk, sk); 
>   /* copies the filter ptr */
>   ...
>   filter = new_sk->sk_filter;
>   if (filter)
>                                      old_fp = sk->sk_filter;
>                                      ...
>                                      sk_filter_release(old_fp);
>                                        if (atomic_dec_and_test(&old_fp->refcnt))
>      atomic_inc(&filter->refcnt);
>                                           /* true */
>                                           call_rcu(&fp->rcu, kfree);
> 
> that's it - after a quiescent state pass the new_sk will have 
> a pointer on kfree-d filter.
> 
> The same problem exists for detaching filter (SO_DETACH_FILTER).
> 
> The proposed fix consists of 3 preparation patches and the fix itself.
> 
> Signed-off-by: Pavel Emelyanov <xemul@...nvz.org>

Looks good, applied.

Thanks for fixing this bug Pavel!
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html