netdev - Re: Invalid sk_policy[] access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 23 Feb 2016 18:05:31 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	sowmini.varadhan@...cle.com
Cc:	mroos@...ux.ee, sparclinux@...r.kernel.org, edumazet@...gle.com,
	netdev@...r.kernel.org
Subject: Re: Invalid sk_policy[] access

From: Sowmini Varadhan <sowmini.varadhan@...cle.com>
Date: Tue, 23 Feb 2016 15:53:29 -0500

> On (02/23/16 22:51), mroos@...ux.ee wrote:
>> Since there are no config-dependent difference in the struct, maybe it's 
>> a compiler version difference for padding/optimization instead?
> 
> possibly. The v440 is using  a Debian 4.6.3-14 gcc, while the
> T5 is using "4.4.7 20120313 (Red Hat 4.4.7-4)"
> 
> But my question from the email remains. Unless I am missing
> something subtle in the code, a  struct request_sock and a 
> struct sock only have the sock_common part in common. So casting
> a request_sock as a struct sock may have issues?

Of course it can have issues and contextually we have to be careful
about what the code can assume about that casted 'sk' object.

Your report looks legit and I was hoping Eric would chime in here with
an analysis.

Eric, we can't access sk->sk_policy[] on a request sock.  I guess we'll
have to use the sk->sk_policy[] of the parent?