netdev - Re: [PATCH net-next v2] net: sched: act_tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190227.213625.273284316654251760.davem@davemloft.net>
Date:   Wed, 27 Feb 2019 21:36:25 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     vladbu@...lanox.com
Cc:     netdev@...r.kernel.org, dcaratti@...hat.com, jhs@...atatu.com,
        xiyou.wangcong@...il.com, jiri@...nulli.us, wenxu@...oud.cn,
        roid@...lanox.com
Subject: Re: [PATCH net-next v2] net: sched: act_tunnel_key: fix metadata
 handling

From: Vlad Buslov <vladbu@...lanox.com>
Date: Mon, 25 Feb 2019 17:30:14 +0200

> Tunnel key action params->tcft_enc_metadata is only set when action is
> TCA_TUNNEL_KEY_ACT_SET. However, metadata pointer is incorrectly
> dereferenced during tunnel key init and release without verifying that
> action is if correct type, which causes NULL pointer dereference. Metadata
> tunnel dst_cache is also leaked on action overwrite.
> 
> Fix metadata handling:
> - Verify that metadata pointer is not NULL before dereferencing it in
>   tunnel_key_init error handling code.
> - Move dst_cache destroy code into tunnel_key_release_params() function
>   that is called in both action overwrite and release cases (fixes resource
>   leak) and verifies that actions has correct type before dereferencing
>   metadata pointer (fixes NULL pointer dereference).
> 
> Oops with KASAN enabled during tdc tests execution:
  ...
> Fixes: 41411e2fd6b8 ("net/sched: act_tunnel_key: Add dst_cache support")
> Signed-off-by: Vlad Buslov <vladbu@...lanox.com>
> ---
> Changes from V1 to V2:
> - Extract metadata->dst error handler fix into standalone patch that targets
>   net.

Applied, thanks Vlad.