linux-kernel - Re: [net] xfrm_user: use xfrm_state_put to free xfrm_state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Nov 2018 16:00:45 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Pan Bian <bianpan2016@....com>
Cc:     Steffen Klassert <steffen.klassert@...unet.com>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, Pan Bian <bianpan2013@....com>,
        Mathias Krause <minipli@...glemail.com>
Subject: Re: [net] xfrm_user: use xfrm_state_put to free xfrm_state_alloc
 return value

On Wed, Nov 21, 2018 at 02:57:48PM +0800, Pan Bian wrote:
> From: Pan Bian <bianpan2013@....com>
> 
> The memory chunk allocated by xfrm_state_alloc() should be released with
> xfrm_state_put(), not kfree.
> 
> Signed-off-by: Pan Bian <bianpan2013@....com>

This bug was introduced by

	commit 565f0fa902b64020d5d147ff1708567e9e0b6e49
	Author: Mathias Krause <minipli@...glemail.com>
	Date:   Thu May 3 10:55:07 2018 +0200

While using xfrm_state_put may work it's certainly not the designed
to do this.  We should instead export a function that calls
kmem_cache_free on xfrm_state directly and use that here.

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt