netdev - RE: [PATCH]: tipc: Fix oops on send prior to entering networked mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <29C1DC0826876849BDD9F1C67ABA2943070F0E2E@ala-mail09.corp.ad.wrs.com>
Date:	Tue, 23 Feb 2010 08:21:25 -0800
From:	"Stephens, Allan" <allan.stephens@...driver.com>
To:	"Neil Horman" <nhorman@...driver.com>
Cc:	<netdev@...r.kernel.org>, <jon.maloy@...csson.com>,
	<tipc-discussion@...ts.sourceforge.net>, <davem@...emloft.net>
Subject: RE: [PATCH]: tipc: Fix oops on send prior to entering networked mode

Neil wrote: 

> I agree that you patch fixes the exact problem that I 
> reported here, but theres more to it than that.  A quick grep 
> of the tipc stack reveals the following
> symbols:
> tipc_bearers
> media_list
> tipc_local_nodes
> bcbearer
> bclink
> tipc_net.zones
> 
> All of these symbols:
> 
> 1) Are allocated dynamically in tipc_net_start, _after_ 
> tipc_mode is set to TIPC_NET_MODE
> 
> 2) dereferenced without NULL pointer checks in either the 
> send path or in the netlink configuration path, both of which 
> are reachable from user space.
> 
> So your patch fixes the last item on your list, but what 
> about the others?  In fact, I'll bet I can very quickly 
> change the application to trip over a null tipc_local_nodes 
> dereference by changing the destination address to be 
> something within zone 0, cluster 0.

The semantics of TIPC addressing don't allow a node address of the form
<0.0.N> where N != 0, so this kind of a send ateempt should be caught
and handled by TIPC.  However, you've already found one missing error
check, so it's certainly worth trying it out!

Regards,
Al
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html