netdev - Re: [PATCH net] net: Check for fullsock in sock_i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 02 Nov 2016 10:18:27 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     subashab@...eaurora.org
Cc:     netdev@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
        Lorenzo Colitti <lorenzo@...gle.com>
Subject: Re: [PATCH net] net: Check for fullsock in sock_i_uid()

On Wed, 2016-11-02 at 11:05 -0600, subashab@...eaurora.org wrote:
> > This would be a bug in the caller.
> > 
> > Can you give us the complete stack trace leading to the problem you
> > had ?
> > 
> > Thanks !
> 
> Thanks Eric for the clarification. In that case, the bug is in the 
> IDLETIMER target in Android kernel.
> https://android.googlesource.com/kernel/common/+/android-4.4/net/netfilter/xt_IDLETIMER.c#356
> 
> Here is the call stack.

Sure, please fix Android, and not add ugly work around in linux kernel.

Lorenzo, have'nt you already fixed all these bugs ?

if (skb && skb->sk)
	timer->uid = from_kuid_munged(current_user_ns(),
				 sock_i_uid(skb_to_full_sk(skb)));

Thanks