netdev - Re: [Patch net] rds: avoid calling sock_kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20141014.170311.2104285680542945400.davem@davemloft.net>
Date:	Tue, 14 Oct 2014 17:03:11 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	xiyou.wangcong@...il.com
Cc:	netdev@...r.kernel.org, rds-devel@....oracle.com,
	chien.yen@...cle.com, stephen@...workplumber.org,
	cwang@...pensource.com
Subject: Re: [Patch net] rds: avoid calling sock_kfree_s() on allocation
 failure

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Tue, 14 Oct 2014 12:35:08 -0700

> From: Cong Wang <cwang@...pensource.com>
> 
> It is okay to free a NULL pointer but not okay to mischarge the socket optmem
> accounting. Compile test only.
> 
> Reported-by: rucsoftsec@...il.com
> Cc: Chien Yen <chien.yen@...cle.com>
> Cc: Stephen Hemminger <stephen@...workplumber.org>
> Signed-off-by: Cong Wang <cwang@...pensource.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied, and I'm going to add the following bug check to the tree too.

====================
[PATCH] net: Trap attempts to call sock_kfree_s() with a NULL pointer.

Unlike normal kfree() it is never right to call sock_kfree_s() with
a NULL pointer, because sock_kfree_s() also has the side effect of
discharging the memory from the sockets quota.

Signed-off-by: David S. Miller <davem@...emloft.net>
---
 net/core/sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/sock.c b/net/core/sock.c
index b4f3ea2..15e0c67 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1718,6 +1718,8 @@ EXPORT_SYMBOL(sock_kmalloc);
  */
 void sock_kfree_s(struct sock *sk, void *mem, int size)
 {
+	if (WARN_ON_ONCE(!mem))
+		return;
 	kfree(mem);
 	atomic_sub(size, &sk->sk_omem_alloc);
 }
-- 
1.7.11.7

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html