netdev - Re: [PATCH net v2 RESEND] xfrm: Fix crash observed during device unregistration and decryption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 24 Mar 2016 14:30:27 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	subashab@...eaurora.org
Cc:	netdev@...r.kernel.org, steffen.klassert@...unet.com,
	eric.dumazet@...il.com, jeromes@...eaurora.org
Subject: Re: [PATCH net v2 RESEND] xfrm: Fix crash observed during device
 unregistration and decryption

From: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
Date: Wed, 23 Mar 2016 22:39:50 -0600

> A crash is observed when a decrypted packet is processed in receive
> path. get_rps_cpus() tries to dereference the skb->dev fields but it
> appears that the device is freed from the poison pattern.
 ...
> Following are the sequence of events observed -
> 
> - Encrypted packet in receive path from netdevice is queued
> - Encrypted packet queued for decryption (asynchronous)
> - Netdevice brought down and freed
> - Packet is decrypted and returned through callback in esp_input_done
> - Packet is queued again for process in network stack using netif_rx
> 
> Since the device appears to have been freed, the dereference of
> skb->dev in get_rps_cpus() leads to an unhandled page fault
> exception.
> 
> Fix this by holding on to device reference when queueing packets
> asynchronously and releasing the reference on call back return.
> 
> v2: Make the change generic to xfrm as mentioned by Steffen and
> update the title to xfrm
> 
> Suggested-by: Herbert Xu <herbert@...dor.apana.org.au>
> Signed-off-by: Jerome Stanislaus <jeromes@...eaurora.org>
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>

Applied and queued up for -stable, thanks.