netdev - Re: [PATCH 1/2] dccp: Unlock sock before calling sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 02 Mar 2017 13:59:20 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     acme@...nel.org
Cc:     netdev@...r.kernel.org, acme@...hat.com, xiyou.wangcong@...il.com,
        edumazet@...gle.com, gerrit@....abdn.ac.uk, tglx@...utronix.de
Subject: Re: [PATCH 1/2] dccp: Unlock sock before calling sk_free()

From: Arnaldo Carvalho de Melo <acme@...nel.org>
Date: Wed,  1 Mar 2017 16:35:07 -0300

> From: Arnaldo Carvalho de Melo <acme@...hat.com>
> 
> The code where sk_clone() came from created a new socket and locked it,
> but then, on the error path didn't unlock it.
> 
> This problem stayed there for a long while, till b0691c8ee7c2 ("net:
> Unlock sock before calling sk_free()") fixed it, but unfortunately the
> callers of sk_clone() (now sk_clone_locked()) were not audited and the
> one in dccp_create_openreq_child() remained.
> 
> Now in the age of the syskaller fuzzer, this was finally uncovered, as
> reported by Dmitry:
 ...
> Fix it just like was done by b0691c8ee7c2 ("net: Unlock sock before calling
> sk_free()").
> 
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Cong Wang <xiyou.wangcong@...il.com>
> Cc: Eric Dumazet <edumazet@...gle.com>
> Cc: Gerrit Renker <gerrit@....abdn.ac.uk>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Link: http://lkml.kernel.org/r/20170301153510.GE15145@kernel.org
> Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>

Applied and queued up for -stable.