netdev - Re: [PATCH] net: tun: release the reference of tun device in tun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <517A0BE2.9080503@redhat.com>
Date:	Fri, 26 Apr 2013 13:08:50 +0800
From:	Jason Wang <jasowang@...hat.com>
To:	Arkadiusz Miskiewicz <a.miskiewicz@...il.com>
CC:	Gao feng <gaofeng@...fujitsu.com>, netdev@...r.kernel.org
Subject: Re: [PATCH] net: tun: release the reference of tun device in tun_recvmsg

On 04/26/2013 01:03 PM, Gao feng wrote:
> On 04/25/2013 11:04 PM, Arkadiusz Miskiewicz wrote:
>> On Thursday 25 of April 2013, Gao feng wrote:
>>> We forget to release the reference of tun device in tun_recvmsg.
>>> bug introduced in commit 54f968d6efdbf7dec36faa44fc11f01b0e4d1990
>>> (tuntap: move socket to tun_file)
>> Hm, still hitting the problem even with the patch - dmesg:
>>
> Ok, seams there are another problems we haven't discovered.
> it's excellent if you can find out which commit introduces this
> bug by git bisect.
>
> Thanks!

Yes, bisect will be helpful. If you could not do it, please tell me the
steps to reproduce the issue and the tree you used. I just test with
net.git and net-next.git with a tap device created by tunctl, didn't
meet the issue.

>
>> http://pastebin.com/iSm0QJVY
>>
>>
>>> Signed-off-by: Gao feng <gaofeng@...fujitsu.com>
>>> ---
>>>  drivers/net/tun.c | 7 +++++--
>>>  1 file changed, 5 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
>>> index 0c9df2f..dcd0c19 100644
>>> --- a/drivers/net/tun.c
>>> +++ b/drivers/net/tun.c
>>> @@ -1471,14 +1471,17 @@ static int tun_recvmsg(struct kiocb *iocb, struct
>>> socket *sock, if (!tun)
>>>  		return -EBADFD;
>>>
>>> -	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
>>> -		return -EINVAL;
>>> +	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
>>> +		ret = -EINVAL;
>>> +		goto out;
>>> +	}
>>>  	ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
>>>  			  flags & MSG_DONTWAIT);
>>>  	if (ret > total_len) {
>>>  		m->msg_flags |= MSG_TRUNC;
>>>  		ret = flags & MSG_TRUNC ? ret : total_len;
>>>  	}
>>> +out:
>>>  	tun_put(tun);
>>>  	return ret;
>>>  }
>>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html