| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1368131733.13473.103.camel@edumazet-glaptop> Date: Thu, 09 May 2013 13:35:33 -0700 From: Eric Dumazet <eric.dumazet@...il.com> To: Jiri Pirko <jiri@...nulli.us> Cc: netdev@...r.kernel.org, davem@...emloft.net, sri@...ibm.com, kaber@...sh.net, linux-kernel@...r.kernel.org, mtesar@...hat.com Subject: Re: [patch net] macvlan: fix passthru mode race between dev removal and rx path On Thu, 2013-05-09 at 16:23 +0200, Jiri Pirko wrote: > Currently, if macvlan in passthru mode is created and data are rxed and > you remove this device, following panic happens: > > NULL pointer dereference at 0000000000000198 > IP: [<ffffffffa0196058>] macvlan_handle_frame+0x153/0x1f7 [macvlan] > ... > > Reason of the panic is that list_first_entry() is blindly called in > macvlan_handle_frame() even if the list was empty. vlan is set to > incorrect pointer which leads to the crash. > > I'm fixing this by protecting port->vlans list by rcu and by preventing > from getting incorrect pointer in case the list is empty. > > Introduced by: commit eb06acdc85585f2 "macvlan: Introduce 'passthru' mode to takeover the underlying device" > > Signed-off-by: Jiri Pirko <jiri@...nulli.us> > --- Acked-by: Eric Dumazet <edumazet@...gle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists