netdev - [ROSE/AX25] af_rose: rose

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080402064107.GA3975@ff.dom.local>
Date:	Wed, 2 Apr 2008 06:41:07 +0000
From:	Jarek Poplawski <jarkao2@...il.com>
To:	"David S. Miller" <davem@...emloft.net>
Cc:	Bernard Pidoux <bpidoux@...e.fr>,
	Ralf Baechle DL5RB <ralf@...ux-mips.org>,
	Linux Netdev List <netdev@...r.kernel.org>
Subject: [ROSE/AX25] af_rose: rose_release() fix

On Tue, Apr 01, 2008 at 10:37:02PM +0200, Bernard Pidoux wrote:
...
> Three Linux boxes have been are running for more than 24 hours now with  
> only patch #5. They handled a lot of AX25 connections with no problems.
>
> Thus, we can reasonably expect that things are going to stay stable.
>
> If you want to commit patch#5 I will sustain it very much.
>
> I hope that it will be accepted quickly in order to make a coherent  
> system with AX25 patches already applied or not yet applied (if any).
>
> Thank you very much Jarek for this very nice job.

The same to you Bernard!


David & Ralf:

Here I resend the testing patch #5 from this thread: (the only change
- it's against current netdev tree, so 1 line offset added).

Thanks,
Jarek P.

-------------------->

Subject: [ROSE/AX25] af_rose: rose_release() fix

rose_release() doesn't release sockets properly, e.g. it skips
sock_orphan(), so OOPSes are triggered in sock_def_write_space(),
which was observed especially while ROSE skbs were kfreed from
ax25_frames_acked(). There is also sock_hold() and lock_sock()
added - similarly to ax25_release(). Thanks to Bernard Pidoux for
substantial help in debugging this problem.


Signed-off-by: Jarek Poplawski <jarkao2@...il.com>
Reported-and-tested-by: Bernard Pidoux <bpidoux@...e.fr>
Cc: Ralf Baechle DL5RB <ralf@...ux-mips.org>

---

 net/rose/af_rose.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 92d85c3..d1ff3f8 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -598,17 +598,24 @@ static int rose_release(struct socket *sock)
 
 	if (sk == NULL) return 0;
 
+	sock_hold(sk);
+	sock_orphan(sk);
+	lock_sock(sk);
 	rose = rose_sk(sk);
 
 	switch (rose->state) {
 	case ROSE_STATE_0:
+		release_sock(sk);
 		rose_disconnect(sk, 0, -1, -1);
+		lock_sock(sk);
 		rose_destroy_socket(sk);
 		break;
 
 	case ROSE_STATE_2:
 		rose->neighbour->use--;
+		release_sock(sk);
 		rose_disconnect(sk, 0, -1, -1);
+		lock_sock(sk);
 		rose_destroy_socket(sk);
 		break;
 
@@ -633,6 +640,8 @@ static int rose_release(struct socket *sock)
 	}
 
 	sock->sk = NULL;
+	release_sock(sk);
+	sock_put(sk);
 
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html