netdev - Re: use after free bug in socket code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 07 Jul 2009 14:15:01 +0200
From:	Oliver Hartkopp <oliver@...tkopp.net>
To:	David Miller <davem@...emloft.net>,
	Urs Thuermann <urs@...ogud.escape.de>
CC:	LW@...O-electronics.de, netdev@...r.kernel.org,
	urs.thuermann@...kswagen.de
Subject: Re: use after free bug in socket code

David Miller wrote:
> From: Lothar Waßmann <LW@...O-electronics.de>
> Date: Thu, 2 Jul 2009 13:26:30 +0200
> 
>> Hi,
>>
>> while developing a canbus driver (with kernel 2.6.30-rc4) I
>> encountered a use-after-free bug that led to the following crash (due
>> to CONFIG_DEBUG_SLAB being enabled):
>  ...
>> With the following patch I could alleviate the problem and did not
>> find any negative side effects, but I'm not sure, whether this is the
>> Right Thing(TM), since I'm not too familiar with the networking code:
>  ...
>> Any comments on this?
> 
> A patch like this shouldn't be needed.
> 
> Can one of the CAN folks look into this?

Hi Dave,

i did - but i had no concerns that Lothars remark was an appropriate request.

I'm not the socket layer expert but IMO this looks like something to be fixed
in standard networking code.

The only thing we do in out private sk->sk_destruct function is:

   skb_queue_purge(&sk->sk_receive_queue);

As Urs is currently out of office, i added his private mail address ...

Regards,
Oliver

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html