netdev - Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <593e8213-16ea-0a9c-2a23-63450c770455@gmail.com>
Date:   Mon, 9 Jul 2018 08:17:00 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Ahern <dsa@...ulusnetworks.com>,
        Lorenzo Colitti <lorenzo@...gle.com>,
        Eric Dumazet <eric.dumazet@...il.com>
Cc:     David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
        Alistair Strachan <astrachan@...gle.com>,
        Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
Subject: Re: [PATCH net] net: diag: Don't double-free TCP_NEW_SYN_RECV sockets
 in tcp_abort



On 07/09/2018 07:59 AM, David Ahern wrote:
> On 7/8/18 10:53 PM, Lorenzo Colitti wrote:
>> On Sat, Jul 7, 2018 at 10:29 PM Eric Dumazet <eric.dumazet@...il.com> wrote:
>>>>> Tested: passes Android sock_diag_test.py, which exercises this codepath
>>>>
>>>> If this Android test case exercises this path, why didn't it trigger
>>>> the double free and thus cause this bug to be found much sooner?
>>>>
>>>> Just curious.
>>>
>>> Presumably android has not backported yet the refcount_t stuff in their kernels.
>>
>> That's correct. We only started seeing this on 4.14, which is not yet
>> in the field.
> 
> Prior to 4.12 syn-recv sockets did not show up in the list, so it could
> not be closed through the diag API. I did not chase it to a specific
> commit between 4.11 (no syn-recv in 'ss -ta') and 4.12 (syn-recv shows
> up in 'ss -ta').
> 

I suggest you look more closely to tcp_abort(), the function you changed
in commit d7226c7a4dd1  (linux-4.8)

Then you will see it had support for syn-recv since linux-4.5

So I do not understand your 4.11/4.12 mentions at all.

"ss -ta" always had dumped syn-recv request sockets.