netdev - Re: [PATCH linux-2.6.32.y] sctp: unbalanced rcu lock in ip_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20131108204806.GC5652@1wt.eu>
Date:	Fri, 8 Nov 2013 21:48:06 +0100
From:	Willy Tarreau <w@....eu>
To:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
Cc:	netdev@...r.kernel.org, davem@...emloft.net,
	eric.dumazet@...il.com, ben@...adent.org.uk, stable@...r.kernel.org
Subject: Re: [PATCH linux-2.6.32.y] sctp: unbalanced rcu lock in ip_queue_xmit()

Hi Nicolas,

On Fri, Nov 08, 2013 at 11:13:55AM +0100, Nicolas Dichtel wrote:
> The bug was introduced by commit b8710128e201 ("inet: add RCU protection to
> inet->opt") (it's a backport of upstream commit f6d8bd051c39).
> 
> In SCTP case, packet is already routed, hence we jump to the label
> 'packet_routed', but without rcu_read_lock(). After this label,
> rcu_read_unlock() is called unconditionally.

I've just queued it for 2.6.32.62. Thanks!

Willy

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html