netdev - Re: [PATCH net] ppp: prevent unregistered channels from connecting to PPP units

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180304.184406.446255603611101639.davem@davemloft.net>
Date:   Sun, 04 Mar 2018 18:44:06 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     g.nault@...halink.fr
Cc:     netdev@...r.kernel.org, nuclearcat@...learcat.com, paulus@...ba.org
Subject: Re: [PATCH net] ppp: prevent unregistered channels from connecting
 to PPP units

From: Guillaume Nault <g.nault@...halink.fr>
Date: Fri, 2 Mar 2018 18:41:16 +0100

> PPP units don't hold any reference on the channels connected to it.
> It is the channel's responsibility to ensure that it disconnects from
> its unit before being destroyed.
> In practice, this is ensured by ppp_unregister_channel() disconnecting
> the channel from the unit before dropping a reference on the channel.
> 
> However, it is possible for an unregistered channel to connect to a PPP
> unit: register a channel with ppp_register_net_channel(), attach a
> /dev/ppp file to it with ioctl(PPPIOCATTCHAN), unregister the channel
> with ppp_unregister_channel() and finally connect the /dev/ppp file to
> a PPP unit with ioctl(PPPIOCCONNECT).
> 
> Once in this situation, the channel is only held by the /dev/ppp file,
> which can be released at anytime and free the channel without letting
> the parent PPP unit know. Then the ppp structure ends up with dangling
> pointers in its ->channels list.
> 
> Prevent this scenario by forbidding unregistered channels from
> connecting to PPP units. This maintains the code logic by keeping
> ppp_unregister_channel() responsible from disconnecting the channel if
> necessary and avoids modification on the reference counting mechanism.
> 
> This issue seems to predate git history (successfully reproduced on
> Linux 2.6.26 and earlier PPP commits are unrelated).
> 
> Signed-off-by: Guillaume Nault <g.nault@...halink.fr>

Applied and queued up for -stable, thank you.