netdev - Re: [PATCH] isdn/i4l: fetch the ppp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170920.160155.1154864064570909831.davem@davemloft.net>
Date:   Wed, 20 Sep 2017 16:01:55 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     mengxu.gatech@...il.com
Cc:     isdn@...ux-pingi.de, johannes.berg@...el.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        meng.xu@...ech.edu, sanidhya@...ech.edu, taesoo@...ech.edu
Subject: Re: [PATCH] isdn/i4l: fetch the ppp_write buffer in one shot

From: Meng Xu <mengxu.gatech@...il.com>
Date: Tue, 19 Sep 2017 21:49:55 -0400

> In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is
> fetched twice from userspace. The first fetch is used to peek at the
> protocol of the message and reset the huptimer if necessary; while the
> second fetch copies in the whole buffer. However, given that buf resides
> in userspace memory, a user process can race to change its memory content
> across fetches. By doing so, we can either avoid resetting the huptimer
> for any type of packets (by first setting proto to PPP_LCP and later
> change to the actual type) or force resetting the huptimer for LCP
> packets.
> 
> This patch changes this double-fetch behavior into two single fetches
> decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0).
> A more detailed discussion can be found at
> https://marc.info/?l=linux-kernel&m=150586376926123&w=2
> 
> Signed-off-by: Meng Xu <mengxu.gatech@...il.com>

Applied, thank you.