linux-kernel - Re: [PATCH] wireguard: Fix leaking sockets in wg_socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20231023155950.oyl2olisob6dnvwo@House.clients.dxld.at>
Date:   Mon, 23 Oct 2023 17:59:50 +0200
From:   Daniel Gröber <dxld@...kboxed.org>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, wireguard@...ts.zx2c4.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] wireguard: Fix leaking sockets in wg_socket_init error
 paths

Hi Jason,

On Mon, Oct 23, 2023 at 04:04:13PM +0200, Jason A. Donenfeld wrote:
> The signed-off-by is missing and the subject does not match the format
> of any other wireguard commits.

Ah, I don't usually send kernel patches. Forgot to do format.signOff=true.

> On Mon, Oct 23, 2023 at 03:06:09PM +0200, Daniel Gröber wrote:
> > This doesn't seem to be reachable normally, but while working on a patch
> 
> "Normally" as in what? At all? Or?

I committed this while working on my address/ifindex binding patch[1]
(which I will also resend shortly), at the time I thought this fix makes
sense in isolation but apparently not.

[1]: https://lists.zx2c4.com/pipermail/wireguard/2023-August/008148.html,

> > for the address binding code I ended up triggering this leak and had to
> > reboot to get rid of the leaking wg sockets.
> 
> This commit message doesn't describe any rationale for this patch. Can
> you describe the bug?

It's been a while since I wrote this patch. Unfortunately you didn't
respond to my initial mail in Aug, so some context has already been lost to
time.

I may have been under the mistaken impression that udp_sock_create can
return <0 while leaving *sockp!=NULL, but as I recall it I did re-test with
this patch and it fixed the bug, that I wish I remembered how to trigger
now. Unsatisfying.

--Daniel