netdev - Re: [PATCH net-next 1/1] net sched actions: fix invalid pointer dereferencing if skbedit flags missing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAM_iQpWPPcjmWC6e2hWoxhQRNuCNHwZvhSQqTtvKUt=MwoiwhA@mail.gmail.com>
Date:   Thu, 10 May 2018 10:54:21 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Roman Mashak <mrv@...atatu.com>
Cc:     David Miller <davem@...emloft.net>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        kernel@...atatu.com, Jamal Hadi Salim <jhs@...atatu.com>,
        Jiri Pirko <jiri@...nulli.us>,
        Alexander Duyck <alexander.duyck@...il.com>
Subject: Re: [PATCH net-next 1/1] net sched actions: fix invalid pointer
 dereferencing if skbedit flags missing

On Wed, May 9, 2018 at 2:18 PM, Roman Mashak <mrv@...atatu.com> wrote:
> The caller calls action's ->init() and passes pointer to "struct tc_action *a",
> which later may initialized to point at the existing action, otherwise
> "struct tc_action *a" is still invalid, and therefore dereferencing it is error.

So technically we just need to check if(exists) before calling
tcf_idr_release(), right?


>
> So checking flags should be done as early as possible, before idr lookups.

In theory, this could break the case of binding an existing action.
But in practice it seems nonsense to pass invalid flags in this case
either, so probably this is okay.

BTW, this should be a candidate for -net and possibly -stable too.