netdev - Re: [PATCH net-next] inet: Always increment refcount in inet_twsk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b4cafdee6aa80ecc2e36f1499c4145b9.squirrel@www.codeaurora.org>
Date:	Fri, 24 Jul 2015 01:49:27 -0000
From:	subashab@...eaurora.org
To:	eric.dumazet@...il.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH net-next] inet: Always increment refcount in
 inet_twsk_schedule

> Actually we do increment refcnt, for every socket found in ehash.
>
> Carefully read again __inet_lookup_established()
>
> This code is generic for ESTABLISH and TIME-WAIT sockets
>
> If you found a code that performed the lookup without taking the refcnt,
> please point me at it, this would be a serious bug.

>From my previous observations, it appears as if
1. this check is bypassed
2. the refcount is incremented here but is decremented before it reaches
the packet processing in tcp_timewait_state_process()

I will try to debug this and update.

> Is it some Android kernel ?
>
> Android had private modules that needed an update in 3.18

Yes, the kernel is based on Android 3.18.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html