netdev - Re: [PATCHv2 net] pptp: dst_release sk_dst_cache in pptp_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190313.142434.1035963949517231583.davem@davemloft.net>
Date:   Wed, 13 Mar 2019 14:24:34 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     lucien.xin@...il.com
Cc:     netdev@...r.kernel.org, edumazet@...gle.com, xeb@...l.ru
Subject: Re: [PATCHv2 net] pptp: dst_release sk_dst_cache in
 pptp_sock_destruct

From: Xin Long <lucien.xin@...il.com>
Date: Wed, 13 Mar 2019 17:00:48 +0800

> sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
> so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
> otherwise, the dst refcnt will leak.
> 
> It can be reproduced by this syz log:
> 
>   r1 = socket$pptp(0x18, 0x1, 0x2)
>   bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
>   connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
> 
> Consecutive dmesg warnings will occur:
> 
>   unregister_netdevice: waiting for lo to become free. Usage count = 1
> 
> v1->v2:
>   - use rcu_dereference_protected() instead of rcu_dereference_check(),
>     as suggested by Eric.
> 
> Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
> Reported-by: Xiumei Mu <xmu@...hat.com>
> Signed-off-by: Xin Long <lucien.xin@...il.com>

Applied and queued up for -stable, thank you.