linux-kernel - Re: net: nfc: BUG and panic in accept() on 3.5-rc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1339426241.4999.62.camel@lappy>
Date:	Mon, 11 Jun 2012 16:50:41 +0200
From:	Sasha Levin <levinsasha928@...il.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Samuel Ortiz <sameo@...ux.intel.com>,
	David Miller <davem@...emloft.net>,
	lauro.venancio@...nbossa.org, aloisio.almeida@...nbossa.org,
	Dave Jones <davej@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	linux-wireless <linux-wireless@...r.kernel.org>
Subject: Re: net: nfc: BUG and panic in accept() on 3.5-rc2

On Mon, 2012-06-11 at 16:41 +0200, Eric Dumazet wrote:
> On Mon, 2012-06-11 at 16:41 +0200, Samuel Ortiz wrote:
> > Hi Sasha,
> > 
> > On Mon, Jun 11, 2012 at 04:00:41PM +0200, Sasha Levin wrote:
> > > Hi all,
> > > 
> > > I've stumbled on the following while fuzzing with trinity inside a KVM tools guest, running on 3.5-rc2:
> > > 
> > Thanks for the report, it could be worth adding this one to
> > bugzilla.kernel.org.
> > 
> > What's trinity ?
> > Also, if this one is reproducible, would you mind sharing some details about
> > how we could reproduce it ?
> 
> Well, bugfix should be trivial enough ;)
> 
> diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
> index ec1134c..208416e 100644
> --- a/net/nfc/rawsock.c
> +++ b/net/nfc/rawsock.c
> @@ -54,11 +54,12 @@ static int rawsock_release(struct socket *sock)
>  {
>  	struct sock *sk = sock->sk;
>  
> -	pr_debug("sock=%p\n", sock);
> -
> -	sock_orphan(sk);
> -	sock_put(sk);
> +	pr_debug("sock=%p sk=%p\n", sock, sk);
>  
> +	if (sk) {
> +		sock_orphan(sk);
> +		sock_put(sk);
> +	}
>  	return 0;
>  }

Eric, Is there something that documents at what state each of the
callbacks in the network subsystem can be called? Like a big flow chart
of some sorts?

I'm asking because I've looked at this as well before sending this mail,
and while the fix does look trivial, I wasn't sure whether it is really
the correct fix, or the problem is that this callback wasn't supposed be
called at all so something else is broken (we had such issue with
namespaces and unshare() not long ago).



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/