lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 20 Apr 2012 23:07:40 +0800 From: Huajun Li <huajun.li.lee@...il.com> To: Ming Lei <tom.leiming@...il.com> Cc: Oliver Neukum <oneukum@...e.de>, Alan Stern <stern@...land.harvard.edu>, Dave Jones <davej@...hat.com>, netdev@...r.kernel.org, linux-usb@...r.kernel.org, Fedora Kernel Team <kernel-team@...oraproject.org> Subject: Re: use-after-free in usbnet On Fri, Apr 20, 2012 at 10:56 PM, Huajun Li <huajun.li.lee@...il.com> wrote: > On Fri, Apr 20, 2012 at 10:22 PM, Ming Lei <tom.leiming@...il.com> wrote: >> On Fri, Apr 20, 2012 at 9:37 PM, Huajun Li <huajun.li.lee@...il.com> wrote: >>> >>> Above patch has already been integrated to mainline. However, maybe >>> there still exists another potentail use-after-free issue, here is a >>> case: >>> After release the lock in unlink_urbs(), defer_bh() may move >>> current skb from rxq/txq to dev->done queue, even cause the skb be >>> released. Then in next loop cycle, it can't refer to expected skb, and >>> may Oops again. >> >> Could you explain in a bit detail? Why can't the expected skb be refered >> to in next loop? > > > unlink_urbs() complete handler > -------------------------------------- > ------------------------------------------------- > spin_unlock_irqrestore() > rx_complete() > derver_bh() > > __skb_unlink() > > __skb_queue_tail(&dev->done, skb) =======> skb is moved to > dev->done, and can be freed by usbnet_bh() > skb_queue_walk_safe() > tmp = skb->next ===> refer to freed skb > Sorry, email client messed up these lines, resend it: unlink_urbs() complete handler ------------------------ ------------------------------ spin_unlock_irqrestore() rx_complete() derver_bh() __skb_unlink() __skb_queue_tail(&dev->done, skb) =======> skb is moved to dev->done, and can be freed by usbnet_bh() skb_queue_walk_safe() tmp = skb->next ===> refer to freed skb -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists