netdev - Re: [PATCH net 1/3] sctp: sctp_sock_migrate() returns error if sctp_bind_addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Mar 2019 13:59:09 -0300
From:   Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:     Xin Long <lucien.xin@...il.com>
Cc:     network dev <netdev@...r.kernel.org>, linux-sctp@...r.kernel.org,
        davem <davem@...emloft.net>, Neil Horman <nhorman@...driver.com>
Subject: Re: [PATCH net 1/3] sctp: sctp_sock_migrate() returns error if
 sctp_bind_addr_dup() fails

On Fri, Mar 08, 2019 at 11:48:10AM +0800, Xin Long wrote:
> On Fri, Mar 8, 2019 at 2:25 AM Marcelo Ricardo Leitner
> <marcelo.leitner@...il.com> wrote:
> >
> > On Sun, Mar 03, 2019 at 05:54:53PM +0800, Xin Long wrote:
> > > It should fail to create the new sk if sctp_bind_addr_dup() fails
> > > when accepting or peeloff an association.
> > >
> > > Signed-off-by: Xin Long <lucien.xin@...il.com>
> > > ---
> > >  net/sctp/socket.c | 34 ++++++++++++++++++++++++----------
> > >  1 file changed, 24 insertions(+), 10 deletions(-)
> > >
> > > diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> > > index a2771b3..22adb8d 100644
> > > --- a/net/sctp/socket.c
> > > +++ b/net/sctp/socket.c
> > > @@ -102,9 +102,9 @@ static int sctp_send_asconf(struct sctp_association *asoc,
> > >                           struct sctp_chunk *chunk);
> > >  static int sctp_do_bind(struct sock *, union sctp_addr *, int);
> > >  static int sctp_autobind(struct sock *sk);
> > > -static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
> > > -                           struct sctp_association *assoc,
> > > -                           enum sctp_socket_type type);
> > > +static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
> > > +                          struct sctp_association *assoc,
> > > +                          enum sctp_socket_type type);
> > >
> > >  static unsigned long sctp_memory_pressure;
> > >  static atomic_long_t sctp_memory_allocated;
> > > @@ -4655,7 +4655,11 @@ static struct sock *sctp_accept(struct sock *sk, int flags, int *err, bool kern)
> > >       /* Populate the fields of the newsk from the oldsk and migrate the
> > >        * asoc to the newsk.
> > >        */
> > > -     sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
> > > +     error = sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
> > > +     if (error) {
> > > +             sk_common_release(newsk);
> > > +             newsk = NULL;
> > > +     }
> > >
> > >  out:
> > >       release_sock(sk);
> > > @@ -5401,7 +5405,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
> > >       /* Populate the fields of the newsk from the oldsk and migrate the
> > >        * asoc to the newsk.
> > >        */
> > > -     sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
> > > +     err = sctp_sock_migrate(sk, sock->sk, asoc,
> > > +                             SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
> > > +     if (err) {
> > > +             sock_release(sock);
> >
> > I'm having a hard time understanding why it needs sock_release() here
> > and sk_common_release() in the above chunk. AFAICT by here (after
> > sctp_sock_migrate call) the sockets are pretty much the same. Mind
> > elaborating please?
> In sctp_do_peeloff(),'sock' is 'struct socket' created by sock_create(),
> which should be freed by sock_release(struct socket *sock), otherwise
> no place takes care of its freeing.
> (sock_create() also create sock->sk)
> 
> In sctp_accept(), 'newsk' is 'struct sock' created by sk_alloc(), and
> it should be freed by sk_common_release(). Note by then sock->sk is not
> yet set to 'newsk', so when it return errs, outside can't free newsk
> when freeing sock.
> (sys_accept() calls sock_alloc() directly that doesn't set sock->sk)

Thanks.

  Marcelo