netdev - Re: [PATCH][AX25] ax25_out: check skb for NULL in ax25

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <025801c86ea3$75add3f0$453c822c@dg8ngn>
Date:	Thu, 14 Feb 2008 01:49:29 +0100
From:	"Jann Traschewski" <jann@....de>
To:	"'Jarek Poplawski'" <jarkao2@...il.com>,
	"'David Miller'" <davem@...emloft.net>
Cc:	"'Bernard Pidoux F6BVP'" <f6bvp@...e.fr>,
	"'Ralf Baechle'" <ralf@...ux-mips.org>, <netdev@...r.kernel.org>
Subject: Re: [PATCH][AX25] ax25_out: check skb for NULL in ax25_kick()

Applied and stable with Kernel 2.6.24.2 since 12 hours.
Regards,
Jann

> -----Ursprüngliche Nachricht-----
> Von: Jarek Poplawski [mailto:jarkao2@...il.com] 
> Gesendet: Mittwoch, 13. Februar 2008 12:56
> An: David Miller
> Cc: Jann Traschewski; Bernard Pidoux F6BVP; Ralf Baechle; 
> netdev@...r.kernel.org
> Betreff: [PATCH][AX25] ax25_out: check skb for NULL in ax25_kick()
> 
> Hi,
> 
> Here is an "official" version of "testing patch #2" from this thread.
> The only difference: ax25->vs is changed only after checking 
> skb is not NULL (plus a comment). IMHO it could be applied.
> 
> Thanks,
> Jarek P.
> 
> ---------------->
> 
> Subject: [AX25] ax25_out: check skb for NULL in ax25_kick()
> 
> According to some OOPS reports ax25_kick tries to clone NULL 
> skbs sometimes. It looks like a race with 
> ax25_clear_queues(). Probably there is no need to add more 
> than a simple check for this yet.
> Another report suggested there are probably also cases where ax25
> ->paclen == 0 can happen in ax25_output(); this wasn't confirmed
> during testing but let's leave this debugging check for some time.
> 
> 
> Reported-and-tested-by: Jann Traschewski <jann@....de>
> Signed-off-by: Jarek Poplawski <jarkao2@...il.com>
> 
> ---
> 
> diff -Nurp 2.6.24-mm1-/net/ax25/ax25_out.c 
> 2.6.24-mm1+/net/ax25/ax25_out.c
> --- 2.6.24-mm1-/net/ax25/ax25_out.c	2008-01-24 
> 22:58:37.000000000 +0000
> +++ 2.6.24-mm1+/net/ax25/ax25_out.c	2008-02-13 
> 10:43:50.000000000 +0000
> @@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int pacl
>  	unsigned char *p;
>  	int frontlen, len, fragno, ka9qfrag, first = 1;
>  
> +	if (paclen < 16) {
> +		WARN_ON_ONCE(1);
> +		kfree_skb(skb);
> +		return;
> +	}
> +
>  	if ((skb->len - 1) > paclen) {
>  		if (*skb->data == AX25_P_TEXT) {
>  			skb_pull(skb, 1); /* skip PID */
> @@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
>  	if (start == end)
>  		return;
>  
> -	ax25->vs = start;
> -
>  	/*
>  	 * Transmit data until either we're out of data to send or
>  	 * the window is full. Send a poll on the final I frame 
> if @@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
>  
>  	/*
>  	 * Dequeue the frame and copy it.
> +	 * Check for race with ax25_clear_queues().
>  	 */
>  	skb  = skb_dequeue(&ax25->write_queue);
> +	if (!skb)
> +		return;
> +
> +	ax25->vs = start;
>  
>  	do {
>  		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html