linux-kernel - Re: [PATCH 4.19 03/54] sctp: fix refcount bug in sctp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200411182813.GA18221@duo.ucw.cz>
Date:   Sat, 11 Apr 2020 20:28:13 +0200
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Qiujun Huang <hqjagain@...il.com>,
        Marcelo Ricardo Leitner <mleitner@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        syzbot+cea71eec5d6de256d54d@...kaller.appspotmail.com
Subject: Re: [PATCH 4.19 03/54] sctp: fix refcount bug in sctp_wfree

Hi!

> The following case cause the bug:
> for the trouble SKB, it was in outq->transmitted list

Ok... but this is one hell of "interesting" code.

> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -165,29 +165,44 @@ static void sctp_clear_owner_w(struct sc
>  	skb_orphan(chunk->skb);
>  }
>  
> +#define traverse_and_process()	\
> +do {				\
> +	msg = chunk->msg;	\
> +	if (msg == prev_msg)	\
> +		continue;	\
> +	list_for_each_entry(c, &msg->chunks, frag_list) {	\
> +		if ((clear && asoc->base.sk == c->skb->sk) ||	\
> +		    (!clear && asoc->base.sk != c->skb->sk))	\
> +			cb(c);	\
> +	}			\
> +	prev_msg = msg;		\
> +} while (0)

Should this be function?

Do you see how it does "continue"? But the do {} while(0) wrapper eats
the continue. "break" would be more clear here, but they are really
equivalent due to way this macro is used.

It is just very, very confusing.

Best regards,
								Pavel


-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)