linux-kernel - Re: [PATCH v2 3/3] pppoatm: protect against freeing of vcc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1351589962.17077.36.camel@shinybook.infradead.org>
Date:	Tue, 30 Oct 2012 09:39:22 +0000
From:	David Woodhouse <dwmw2@...radead.org>
To:	Krzysztof Mazur <krzysiek@...lesie.net>
Cc:	davem@...emloft.net, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/3] pppoatm: protect against freeing of vcc

On Mon, 2012-10-22 at 19:14 +0200, Krzysztof Mazur wrote:
> The pppoatm gets a reference to atmvcc, but does not increment vcc
> usage count. The vcc uses vcc->sk socket for reference counting,
> so sock_hold() and sock_put() should be used by pppoatm.
> 
> Signed-off-by: Krzysztof Mazur <krzysiek@...lesie.net>
> Cc: David Woodhouse <dwmw2@...radead.org>

Acked-By: David Woodhouse <David.Woodhouse@...el.com>

But did you spot what's in the end of the context of the first hunk...?

> --- a/net/atm/pppoatm.c
> +++ b/net/atm/pppoatm.c
> @@ -154,6 +154,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc
> *atmvcc)
>         tasklet_kill(&pvcc->wakeup_tasklet);
>         ppp_unregister_channel(&pvcc->chan);
>         atmvcc->user_back = NULL;
> +       sock_put(sk_atm(pvcc->atmvcc));
>         kfree(pvcc);
>         /* Gee, I hope we have the big kernel lock here... */
>         module_put(THIS_MODULE);

Fairly sure that hope is unfounded these days... :)

-- 
dwmw2


Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (6171 bytes)