netdev - Re: [PATCH net] soreuseport: fix NULL ptr dereference SO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAB9dFdvj8SJkfbV-pvMRRkkDf16rUrMsYPbEDv=0eWEfWtm0Fg@mail.gmail.com>
Date:	Tue, 19 Jan 2016 15:43:22 -0400
From:	Marc Dionne <marc.c.dionne@...il.com>
To:	Craig Gallek <kraigatgoog@...il.com>
Cc:	netdev <netdev@...r.kernel.org>, David Miller <davem@...emloft.net>
Subject: Re: [PATCH net] soreuseport: fix NULL ptr dereference SO_REUSEPORT
 after bind

On Tue, Jan 19, 2016 at 3:27 PM, Craig Gallek <kraigatgoog@...il.com> wrote:
> From: Craig Gallek <kraig@...gle.com>
>
> Marc Dionne discovered a NULL pointer dereference when setting
> SO_REUSEPORT on a socket after it is bound.
> This patch removes the assumption that at least one socket in the
> reuseport group is bound with the SO_REUSEPORT option before other
> bind calls occur.
>
> Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection")
> Reported-by: Marc Dionne <marc.c.dionne@...il.com>
> Signed-off-by: Craig Gallek <kraig@...gle.com>
> ---
>  include/net/sock_reuseport.h | 2 +-
>  net/core/sock_reuseport.c    | 9 ++++++++-
>  2 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h
> index 7dda3d7adba8..aecd30308d50 100644
> --- a/include/net/sock_reuseport.h
> +++ b/include/net/sock_reuseport.h
> @@ -16,7 +16,7 @@ struct sock_reuseport {
>  };
>
>  extern int reuseport_alloc(struct sock *sk);
> -extern int reuseport_add_sock(struct sock *sk, const struct sock *sk2);
> +extern int reuseport_add_sock(struct sock *sk, struct sock *sk2);
>  extern void reuseport_detach_sock(struct sock *sk);
>  extern struct sock *reuseport_select_sock(struct sock *sk,
>                                           u32 hash,
> diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
> index 1df98c557440..e92b759d906c 100644
> --- a/net/core/sock_reuseport.c
> +++ b/net/core/sock_reuseport.c
> @@ -93,10 +93,17 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse)
>   *  @sk2: Socket belonging to the existing reuseport group.
>   *  May return ENOMEM and not add socket to group under memory pressure.
>   */
> -int reuseport_add_sock(struct sock *sk, const struct sock *sk2)
> +int reuseport_add_sock(struct sock *sk, struct sock *sk2)
>  {
>         struct sock_reuseport *reuse;
>
> +       if (!rcu_access_pointer(sk2->sk_reuseport_cb)) {
> +               int err = reuseport_alloc(sk2);
> +
> +               if (err)
> +                       return err;
> +       }
> +
>         spin_lock_bh(&reuseport_lock);
>         reuse = rcu_dereference_protected(sk2->sk_reuseport_cb,
>                                           lockdep_is_held(&reuseport_lock)),
> --
> 2.6.0.rc2.230.g3dd15c0
>

Tested-by: Marc Dionne <marc.dionne@...istor.com>