netdev - Re: [PATCH net 1/1] net sched filters: fix notification of filter delete with proper handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Oct 2016 11:03:19 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Jiri Pirko <jiri@...nulli.us>
CC:     Jamal Hadi Salim <jhs@...atatu.com>, davem@...emloft.net,
        netdev@...r.kernel.org, xiyou.wangcong@...il.com,
        eric.dumazet@...il.com
Subject: Re: [PATCH net 1/1] net sched filters: fix notification of filter
 delete with proper handle

On 10/24/2016 10:48 AM, Jiri Pirko wrote:
> Mon, Oct 24, 2016 at 12:30:44AM CEST, daniel@...earbox.net wrote:
>> On 10/23/2016 05:35 PM, Jamal Hadi Salim wrote:
>>> From: Jamal Hadi Salim <jhs@...atatu.com>
>>
>> An actual commit message would be good especially if it's a fix
>> for -net tree plus stable. Thanks.
>
> Also a "Fixes:" tag would be nice to have :)

This kernel address leakage dates back to history tree:

Fixes: 4e54c4816bfe ("[NET]: Add tc extensions infrastructure.")

>>> Signed-off-by: Jamal Hadi Salim <jhs@...atatu.com>
>>> ---
>>>    net/sched/cls_api.c | 3 ++-
>>>    1 file changed, 2 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
>>> index 2ee29a3..2b2a797 100644
>>> --- a/net/sched/cls_api.c
>>> +++ b/net/sched/cls_api.c
>>> @@ -345,7 +345,8 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
>>>    			if (err == 0) {
>>>    				struct tcf_proto *next = rtnl_dereference(tp->next);
>>>
>>> -				tfilter_notify(net, skb, n, tp, fh,
>>> +				tfilter_notify(net, skb, n, tp,
>>> +					       t->tcm_handle,
>>>    					       RTM_DELTFILTER, false);
>>>    				if (tcf_destroy(tp, false))
>>>    					RCU_INIT_POINTER(*back, next);
>>>
>>