lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Tue, 08 Apr 2014 22:50:31 +0200
From:	Daniel Borkmann <>
CC:	David Miller <>,,,,
Subject: Re: [PATCH net v2] net: sctp: wake up all assocs if sndbuf policy
 is per socket

On 04/08/2014 09:37 PM, Vlad Yasevich wrote:
> On 04/08/2014 03:04 PM, Daniel Borkmann wrote:
>> On 04/08/2014 08:46 PM, David Miller wrote:
>>> Daniel and Vlad, I'm about to send Linus a pull request.
>>> I know that you still need to fixup this SCTP change and it'll be
>>> in there, but I really need to get the changes in my tree staged
>>> so that I can do a set of -stable submissions.
>>> So please don't freak out, I know that this change still needs work
>>> and shouldn't go to -stable just yet :-)
>> Noted, thanks. I think the issue is that in sctp_association_free()
>> we do a list_del(&asoc->asocs) and then flush sctp_outq_free() which
>> will then access on sctp_wfree() a poisoned entry. I think this
>> should be list_del_init() instead.
> Switching to list_del_init() will solve the crash, but will not address
> the issue.  You've just removed an association and need to notify others
> of available space.  You can't do that since you've been unlinked.
> We either need a rcu_style unlink, or detect the delete case and loop
> from the beginning.
> You can do #2 easily enough by looking at asoc->base.dead to decide
> where to start looping.

Agreed, I think #2 is better, so we can simply call and return with
sctp_write_space() if we see that the assoc is dead; I think SCTP is
doing too much deferring to RCU anyway. ;)
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists