netdev - Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 7 Jul 2018 06:58:28 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Miller <davem@...emloft.net>, lorenzo@...gle.com
Cc:     netdev@...r.kernel.org, astrachan@...gle.com,
        subashab@...eaurora.org, dsa@...ulusnetworks.com
Subject: Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets
 in tcp_abort



On 07/07/2018 06:29 AM, Eric Dumazet wrote:
> 
> 
> On 07/07/2018 06:11 AM, David Miller wrote:
>> From: Lorenzo Colitti <lorenzo@...gle.com>
>> Date: Sat,  7 Jul 2018 16:31:40 +0900
>>
>>> Tested: passes Android sock_diag_test.py, which exercises this codepath
>>
>> If this Android test case exercises this path, why didn't it trigger
>> the double free and thus cause this bug to be found much sooner?
>>
>> Just curious.
>>
> 
> Presumably android has not backported yet the refcount_t stuff in their kernels.
> 
> That is a guess though...
> 


Also maybe the confusion comes from the fact that it is not a double free,
but a use-after-free, which might cause a bug on kernels without
refcount_t saturation.