lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Thu, 24 Mar 2016 14:30:27 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	subashab@...eaurora.org
Cc:	netdev@...r.kernel.org, steffen.klassert@...unet.com,
	eric.dumazet@...il.com, jeromes@...eaurora.org
Subject: Re: [PATCH net v2 RESEND] xfrm: Fix crash observed during device
 unregistration and decryption

From: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
Date: Wed, 23 Mar 2016 22:39:50 -0600

> A crash is observed when a decrypted packet is processed in receive
> path. get_rps_cpus() tries to dereference the skb->dev fields but it
> appears that the device is freed from the poison pattern.
 ...
> Following are the sequence of events observed -
> 
> - Encrypted packet in receive path from netdevice is queued
> - Encrypted packet queued for decryption (asynchronous)
> - Netdevice brought down and freed
> - Packet is decrypted and returned through callback in esp_input_done
> - Packet is queued again for process in network stack using netif_rx
> 
> Since the device appears to have been freed, the dereference of
> skb->dev in get_rps_cpus() leads to an unhandled page fault
> exception.
> 
> Fix this by holding on to device reference when queueing packets
> asynchronously and releasing the reference on call back return.
> 
> v2: Make the change generic to xfrm as mentioned by Steffen and
> update the title to xfrm
> 
> Suggested-by: Herbert Xu <herbert@...dor.apana.org.au>
> Signed-off-by: Jerome Stanislaus <jeromes@...eaurora.org>
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>

Applied and queued up for -stable, thanks.

Powered by blists - more mailing lists