netdev - Re: [PATCH]: tcp: Fix queue traversal in tcp_use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0809232214320.14360@wrl-59.cs.helsinki.fi>
Date:	Tue, 23 Sep 2008 22:18:33 +0300 (EEST)
From:	"Ilpo Järvinen" <ilpo.jarvinen@...sinki.fi>
To:	David Miller <davem@...emloft.net>
cc:	Netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH]: tcp: Fix queue traversal in tcp_use_frto().

On Tue, 23 Sep 2008, David Miller wrote:

> 
> One more skb_queue_next() BUG trigger.  I double audited the
> remaining tcp_write_queue_next() cases and they should all
> be good.
> 
> tcp: Fix queue traversal in tcp_use_frto().
> 
> We must check tcp_skb_is_last() before doing a tcp_write_queue_next().
> 
> Signed-off-by: David S. Miller <davem@...emloft.net>
> ---
>  net/ipv4/tcp_input.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index cbfe13d..3b76bce 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -1746,6 +1746,8 @@ int tcp_use_frto(struct sock *sk)
>  		return 0;
>  
>  	skb = tcp_write_queue_head(sk);
> +	if (tcp_skb_is_last(sk, skb))
> +		return 1;
>  	skb = tcp_write_queue_next(sk, skb);	/* Skips head */
>  	tcp_for_write_queue_from(skb, sk) {
>  		if (skb == tcp_send_head(sk))
> 

For the record (as you probably know it already), this wasn't actually
a real bug though it hits your BUG_ON since tcp_for_write_queue_from exits
immediately, no garbage gets dereferenced.

-- 
 i.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html