netdev - [PATCH 1/2] net/can bugfix: use after free bug in can protocol drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19037.40189.520170.8242@ipc1.ka-ro>
Date:	Wed, 15 Jul 2009 11:10:21 +0200
From:	Lothar Waßmann <LW@...O-electronics.de>
To:	Wolfgang Grandegger <wg@...ndegger.com>
Cc:	Oliver Hartkopp <oliver@...tkopp.net>,
	Herbert Xu <herbert@...dor.apana.org.au>, davem@...emloft.net,
	netdev@...r.kernel.org, urs.thuermann@...kswagen.de,
	Urs Thuermann <urs@...ogud.escape.de>
Subject: [PATCH 1/2] net/can bugfix: use after free bug in can protocol drivers

Fix a use after free bug in can protocol drivers

The release functions of the can protocol drivers lack a call to
sock_orphan() which leads to referencing freed memory under certain
circumstances.

This patch fixes a bug reported here:
https://lists.berlios.de/pipermail/socketcan-users/2009-July/000985.html

Signed-off-by: Lothar Wassmann <LW@...O-electronics.de>
Acked-by: Oliver Hartkopp <oliver@...tkopp.net>
---
diff -upr linux-2.6.30/net/can/bcm.c linux-2.6.30-karo/net/can/bcm.c
--- linux-2.6.30/net/can/bcm.c  2009-06-10 05:05:27.000000000 +0200
+++ linux-2.6.30-karo/net/can/bcm.c        2009-07-14 14:13:01.000000000 +0200
@@ -1469,6 +1469,9 @@ static int bcm_release(struct socket *so
 		bo->ifindex = 0;
 	}
 
+	sock_orphan(sk);
+	sock->sk = NULL;
+
 	release_sock(sk);
 	sock_put(sk);
 
diff -upr linux-2.6.30/net/can/raw.c linux-2.6.30-karo/net/can/raw.c
--- linux-2.6.30/net/can/raw.c  2009-06-10 05:05:27.000000000 +0200
+++ linux-2.6.30-karo/net/can/raw.c        2009-07-14 14:13:07.000000000 +0200
@@ -306,6 +306,9 @@ static int raw_release(struct socket *so
 	ro->bound   = 0;
 	ro->count   = 0;
 
+	sock_orphan(sk);
+	sock->sk = NULL;
+
 	release_sock(sk);
 	sock_put(sk);
 



Lothar Waßmann
-- 
___________________________________________________________

Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen
Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10
Geschäftsführer: Matthias Kaussen
Handelsregistereintrag: Amtsgericht Aachen, HRB 4996

www.karo-electronics.de | info@...o-electronics.de
___________________________________________________________
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html