netdev - [PATCH][Revised Log] PPPoE: Fix flush/close races.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <e6d1cecd0910261306g13346081q37e567f143601c48@mail.gmail.com>
Date:	Mon, 26 Oct 2009 15:06:24 -0500
From:	Michal Ostrowski <mostrows@...il.com>
To:	linux-ppp@...r.kernel.org, netdev <netdev@...r.kernel.org>,
	Cyrill Gorcunov <gorcunov@...il.com>,
	Denys Fedoryschenko <denys@...p.net.lb>
Subject: [PATCH][Revised Log] PPPoE: Fix flush/close races.

Be more careful about the state of pointers during tear-down.
The "pppoe_dev" field can only be looked at safely while holding socket locks.
This subsequently allows for the flush_lock to be killed.

We depend on the PPPOX_CONNECTED state to tell us that that those fields are
valid, so whoever clears that state (pppox_unbind_sock()) is responsible for
the dev_put() call.

We also have to ensure that we delete_item() on all sockets before they are
cleaned up.

The need for these changes has been exposed by scenarios wherein namespace
bindings of ethernet devices change while there are ongoing PPPoE sessions,
which resulted in oopses due to unusual socket connection termination paths,
exposing these issues.

Signed-off-by: Michal Ostrowski <mostrows@...il.com>
Reviewed-by: Cyril Gorcunov <gorcunov@...il.com>
Reported-by: Denys Fedoryschenko <denys@...p.net.lb>
Tested-by: Denys Fedoryschenko <denys@...p.net.lb>
---
 drivers/net/pppoe.c |  129 +++++++++++++++++++++++++++------------------------
 1 files changed, 68 insertions(+), 61 deletions(-)

View attachment "0001-PPPoE-Fix-flush-close-races.patch" of type "text/x-patch" (7871 bytes)