netdev - Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 9 Jul 2018 13:53:15 +0900
From:   Lorenzo Colitti <lorenzo@...gle.com>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
        Alistair Strachan <astrachan@...gle.com>,
        Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>,
        David Ahern <dsa@...ulusnetworks.com>
Subject: Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets
 in tcp_abort

On Sat, Jul 7, 2018 at 10:29 PM Eric Dumazet <eric.dumazet@...il.com> wrote:
> >> Tested: passes Android sock_diag_test.py, which exercises this codepath
> >
> > If this Android test case exercises this path, why didn't it trigger
> > the double free and thus cause this bug to be found much sooner?
> >
> > Just curious.
>
> Presumably android has not backported yet the refcount_t stuff in their kernels.

That's correct. We only started seeing this on 4.14, which is not yet
in the field.

Also, I think this failure does not appear in our continuous test runs
(even on 4.14) because those uses ARCH=um, which is single-threaded.
We're working on making it possible to run the tests on qemu in order
to catch these threading issues, but we're not there yet.