netdev - Re: [PATCH net] llc: call sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 28 Jan 2024 00:13:33 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <ebiggers@...gle.com>, <eric.dumazet@...il.com>,
	<kuba@...nel.org>, <kuniyu@...zon.com>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <syzbot+32b89eaa102b372ff76d@...kaller.appspotmail.com>
Subject: Re: [PATCH net] llc: call sock_orphan() at release time

From: Eric Dumazet <edumazet@...gle.com>
Date: Fri, 26 Jan 2024 16:55:32 +0000
> syzbot reported an interesting trace [1] caused by a stale sk->sk_wq
> pointer in a closed llc socket.
> 
> In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after
> calling proto_ops::release()") Eric Biggers hinted that some protocols
> are missing a sock_orphan(), we need to perform a full audit.
> 
> In net-next, I plan to clear sock->sk from sock_orphan() and
> amend Eric patch to add a warning.
[...]
> 
> Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion")
> Reported-and-tested-by: syzbot+32b89eaa102b372ff76d@...kaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Eric Biggers <ebiggers@...gle.com>
> Cc: Kuniyuki Iwashima <kuniyu@...zon.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

The plan sounds good to me, thanks!


> ---
>  net/llc/af_llc.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
> index 20551cfb7da6d8dd098c906477895e26c080fe32..fde1140d899efc7ba02e6bc3998cb857ef30df14 100644
> --- a/net/llc/af_llc.c
> +++ b/net/llc/af_llc.c
> @@ -226,6 +226,8 @@ static int llc_ui_release(struct socket *sock)
>  	}
>  	netdev_put(llc->dev, &llc->dev_tracker);
>  	sock_put(sk);
> +	sock_orphan(sk);
> +	sock->sk = NULL;
>  	llc_sk_free(sk);
>  out:
>  	return 0;
> -- 
> 2.43.0.429.g432eaa2c6b-goog