netdev - RE: [PATCH] gianfar: Fix invalid TX frames returned on error queue when time stamping.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 09 Jan 2012 08:43:58 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Manfred Rudigier <manfred.rudigier@...cron.at>
Cc:	David Miller <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"afleming@...escale.com" <afleming@...escale.com>,
	"avorontsov@...sta.com" <avorontsov@...sta.com>
Subject: RE: [PATCH] gianfar: Fix invalid TX frames returned on error queue
 when time stamping.

Le lundi 09 janvier 2012 à 08:16 +0100, Manfred Rudigier a écrit :
> From: David Miller [mailto:davem@...emloft.net]
> Sent: Thursday, January 05, 2012 19:27
> 
> >From: Manfred Rudigier <manfred.rudigier@...cron.at>
> >Date: Thu, 5 Jan 2012 15:50:21 +0100
> >
> >> +
> >> +		/* Keep sock if we must return a time stamp on the err queue */
> >> +		skb_new->sk = skb->sk;
> >
> >When I see something like this without any kind of reference counting or
> >similar, I am gravely concerned.
> 
> The skb_tstamp_tx function called during gfar_clean_tx_ring requires
> the skb->sk pointer to be set. Otherwise no time stamp can be queued
> on the socket error queue. 
> What would be the correct way for doing this?

I really wonder how your code was possibly working...

A correct steal sequence maybe 

	skb_new->sk = skb->sk;
	skb->sk = NULL;
	kfree_skb(skb);

Or else, kfree_skb() releases sk reference and eventually socket is
freed before skb_tstamp_tx()



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html