netdev - Re: [PATCH] packet: fix dev refcnt leak when bind fail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20111227.131559.2197088758418537543.davem@davemloft.net>
Date:	Tue, 27 Dec 2011 13:15:59 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	weiyj.lk@...il.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] packet: fix dev refcnt leak when bind fail

From: Wei Yongjun <weiyj.lk@...il.com>
Date: Tue, 27 Dec 2011 12:28:31 +0800

> cc netdev@...r.kernel.org
> 
>> From: Wei Yongjun <weiyj.lk@...il.com>
>> Date: Mon, 26 Dec 2011 17:02:59 +0800
>>
>>> From: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
>>>
>>> If bind is fail such as bind is called after set PACKET_FANOUT
>>> sock option, the dev refcnt will leak.
>>>
>>> Signed-off-by: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
>>
>> The device pointer is stored in ->prot_hook.dev
>>
>> Therefore, it will be released at the latest in packet_release() or
>> earlier if another bind() attempt is done on the socket.
>>
>> There is no leak here as far as I can see.
> 
> Hi David,
> 
> In packet_do_bind(), if po->fanout is set, the device pointer may not be
> stored in ->prot_hook.dev, see the following code:
> 
> static int packet_do_bind(struct sock *sk, struct net_device *dev, ...)
> {
>    struct packet_sock *po = pkt_sk(sk);
> 
>    if (po->fanout)
>        return -EINVAL;
>    ...
>    po->prot_hook.dev = dev;
>    ...
> }
> 
> The leak is exists only if po->fanout is set.

Then it sounds a lot simpler for packet_do_bind() (one location) to
manage this reference drop, rather than every single call site of
packet_do_bind().

Look how complicated you had to make the tests in those call sites
to get the logic right, it's must easier to just add the dev_put()
right at that po->fanout test.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html