netdev - Re: [PATCH net-next-2.6 v4 00/14] l2tp: Introduce L2TPv3 support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 04 Apr 2010 10:14:06 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	jchapman@...alix.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next-2.6 v4 00/14] l2tp: Introduce L2TPv3 support

Le dimanche 04 avril 2010 à 01:02 -0700, David Miller a écrit :
> From: Eric Dumazet <eric.dumazet@...il.com>
> Date: Sun, 04 Apr 2010 09:54:28 +0200
> 
> > [PATCH net-next-2.6] l2tp: unmanaged L2TPv3 tunnels fixes
> > 
> > Followup to commit 789a4a2c 
> > (l2tp: Add support for static unmanaged L2TPv3 tunnels)
> > 
> > One missing init in l2tp_tunnel_sock_create() could access random kernel
> > memory, and a bit field should be unsigned.
> > 
> > Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
> 
> Applied, thanks Eric.

I am going to work on net/l2tp/l2tp_core.c, since RCU conversion is
wrong (but original code was wong too...)

Example :

There is no real protection in following code, since no refcount is
taken on session before releasing rcu_read_lock :

static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
{
        struct l2tp_net *pn = l2tp_pernet(net);
        struct hlist_head *session_list =
                l2tp_session_id_hash_2(pn, session_id);
        struct l2tp_session *session;
        struct hlist_node *walk;

        rcu_read_lock_bh();
        hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
                if (session->session_id == session_id) {
                        rcu_read_unlock_bh();
                        return session;
                }
        }
        rcu_read_unlock_bh();

        return NULL;
}


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html