netdev - Re: [PATCH v3] tun: fix use-after-free when register netdev failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190819.182522.414877916903078544.davem@davemloft.net>
Date:   Mon, 19 Aug 2019 18:25:22 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     yangyingliang@...wei.com
Cc:     netdev@...r.kernel.org, jasowang@...hat.com,
        eric.dumazet@...il.com, xiyou.wangcong@...il.com,
        weiyongjun1@...wei.com
Subject: Re: [PATCH v3] tun: fix use-after-free when register netdev failed

From: Yang Yingliang <yangyingliang@...wei.com>
Date: Mon, 19 Aug 2019 21:31:19 +0800

> Call tun_attach() after register_netdevice() to make sure tfile->tun
> is not published until the netdevice is registered. So the read/write
> thread can not use the tun pointer that may freed by free_netdev().
> (The tun and dev pointer are allocated by alloc_netdev_mqs(), they can
> be freed by netdev_freemem().)

register_netdevice() must always be the last operation in the order of
network device setup.

At the point register_netdevice() is called, the device is visible globally
and therefore all of it's software state must be fully initialized and
ready for us.

You're going to have to find another solution to these problems.