netdev - re: rxrpc: Fix deadlock between call creation and sendmsg/recvmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <383d28fd-9a64-77ac-b8c0-f23408afc0ce@canonical.com>
Date:   Thu, 2 Mar 2017 13:33:46 +0000
From:   Colin Ian King <colin.king@...onical.com>
To:     David Howells <dhowells@...hat.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: rxrpc: Fix deadlock between call creation and sendmsg/recvmsg


I think the following part of the patch is problematic:

        call = rxrpc_find_call_by_user_ID(rx, user_call_ID);
        if (!call) {
+               ret = -EBADSLT;
                if (cmd != RXRPC_CMD_SEND_DATA)
-                       return -EBADSLT;
+                       goto error_release_sock;
+               ret = -EBUSY;

At this point call is null, so the following code is performing a null
pointer dereference on call when accessing call->state.

Detected by CoverityScan CID#1414316 ("Dereference after null check")

+               if (call->state == RXRPC_CALL_UNINITIALISED ||
+                   call->state == RXRPC_CALL_CLIENT_AWAIT_CONN ||
+                   call->state == RXRPC_CALL_SERVER_PREALLOC ||
+                   call->state == RXRPC_CALL_SERVER_SECURING ||
+                   call->state == RXRPC_CALL_SERVER_ACCEPTING)
+                       goto error_release_sock;
                call = rxrpc_new_client_call_for_sendmsg(rx, msg,
user_call_ID,