netdev - Re: use after free bug in socket code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19028.16049.907160.45293@ipc1.ka-ro>
Date:	Wed, 8 Jul 2009 08:37:37 +0200
From:	Lothar Waßmann <LW@...O-electronics.de>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org, urs.thuermann@...kswagen.de,
	oliver.hartkopp@...kswagen.de
Subject: Re: use after free bug in socket code

Hi,

David Miller writes:
> From: Lothar Waßmann <LW@...O-electronics.de>
> Date: Tue, 7 Jul 2009 08:59:59 +0200
> 
> > To me it seems much more logical to invalidate any references from
> > some object 'B' (struct sock) to some object 'A' (struct socket) when
> > object 'A' is being released rather than invalidating them when object
> > 'B' is being released.
> 
> Because B should hold a reference to A in that situation.
> 
> If one object refers to another, it should grab and hold a reference
> to that object.
>
So, could you point me to the place where the reference count of the
socket object is being incremented when a struct sock is associated
with it?
In sock_init_data() where the pointers in question are being
initialized I don't see anything like that:
|	sk_set_socket(sk, sock);
|
|	sock_set_flag(sk, SOCK_ZAPPED);
|
|	if (sock) {
|		sk->sk_type	=	sock->type;
|		sk->sk_sleep	=	&sock->wait;
|		sock->sk	=	sk;
|	} else
|		sk->sk_sleep	=	NULL;

with sk_set_socket() being:
|static inline void sk_set_socket(struct sock *sk, struct socket *sock)
|{
|	sk->sk_socket = sock;
|}



Lothar Waßmann
-- 
___________________________________________________________

Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen
Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10
Geschäftsführer: Matthias Kaussen
Handelsregistereintrag: Amtsgericht Aachen, HRB 4996

www.karo-electronics.de | info@...o-electronics.de
___________________________________________________________
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html