netdev - Fwd: [PATCH] packet: fix dev refcnt leak when bind fail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 27 Dec 2011 12:28:31 +0800
From:	Wei Yongjun <weiyj.lk@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org
Subject: Fwd: [PATCH] packet: fix dev refcnt leak when bind fail

cc netdev@...r.kernel.org

> From: Wei Yongjun <weiyj.lk@...il.com>
> Date: Mon, 26 Dec 2011 17:02:59 +0800
>
>> From: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
>>
>> If bind is fail such as bind is called after set PACKET_FANOUT
>> sock option, the dev refcnt will leak.
>>
>> Signed-off-by: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
>
> The device pointer is stored in ->prot_hook.dev
>
> Therefore, it will be released at the latest in packet_release() or
> earlier if another bind() attempt is done on the socket.
>
> There is no leak here as far as I can see.

Hi David,

In packet_do_bind(), if po->fanout is set, the device pointer may not be
stored in ->prot_hook.dev, see the following code:

static int packet_do_bind(struct sock *sk, struct net_device *dev, ...)
{
   struct packet_sock *po = pkt_sk(sk);

   if (po->fanout)
       return -EINVAL;
   ...
   po->prot_hook.dev = dev;
   ...
}

The leak is exists only if po->fanout is set.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html