linux-kernel - Re: [patch] dpt_i20: several use after free issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1268693291.2853.60.camel@mulgrave.site>
Date:	Mon, 15 Mar 2010 17:48:11 -0500
From:	James Bottomley <James.Bottomley@...e.de>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Dan Carpenter <error27@...il.com>,
	Adaptec OEM Raid Solutions <aacraid@...ptec.com>,
	Yang Hongyang <yanghy@...fujitsu.com>,
	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>,
	Alan Cox <alan@...ux.intel.com>, linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [patch] dpt_i20: several use after free issues

On Mon, 2010-03-15 at 13:45 -0700, Andrew Morton wrote:
> On Mon, 15 Mar 2010 11:26:56 +0300
> Dan Carpenter <error27@...il.com> wrote:
> 
> > adpt_i2o_delete_hba() calls kfree() so we have to save "pHba->next"
> > before calling it.  Also inside adpt_i2o_delete_hba() itself, there
> > was another use after free bug which I fixed by moving the kfree() 
> > down a line.
> 
> erk.  This code should be crashing most gruesomely.  I wonder why it
> doesn't.

I'm tempted to say because we have no users, but actually, for this
driver, I know we do.  So I think it works because most people don't
have poisoning turned on in a running system and there's no sleep
between the free and the use, so no opportunity to reuse the area on the
percpu hot list even in an smp system.

I'll add it to -rc fixes ... when I get the current misc tree broken
apart.

James


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/