netdev - Re: [Patch net] sch_sfb: fix a crash in sfb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b5b69a9-7ace-2d21-f187-7a81fb1dae5a@gmail.com>
Date:   Wed, 11 Sep 2019 23:36:02 +0200
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org
Cc:     syzbot+d5870a903591faaca4ae@...kaller.appspotmail.com,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Jiri Pirko <jiri@...nulli.us>
Subject: Re: [Patch net] sch_sfb: fix a crash in sfb_destroy()



On 9/11/19 8:34 PM, Cong Wang wrote:
> When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL
> pointer which leads to a crash in sfb_destroy().
> 
> Linus suggested three solutions for this problem, the simplest fix
> is just moving the noop_qdisc assignment before tcf_block_get()
> so that qdisc_put() would become a nop.
> 
> Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
> Reported-by: syzbot+d5870a903591faaca4ae@...kaller.appspotmail.com
> Suggested-by: Linus Torvalds <torvalds@...ux-foundation.org>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Jiri Pirko <jiri@...nulli.us>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
> ---
>  net/sched/sch_sfb.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
> index 1dff8506a715..db1c8eb521a2 100644
> --- a/net/sched/sch_sfb.c
> +++ b/net/sched/sch_sfb.c
> @@ -552,11 +552,11 @@ static int sfb_init(struct Qdisc *sch, struct nlattr *opt,
>  	struct sfb_sched_data *q = qdisc_priv(sch);
>  	int err;
>  
> +	q->qdisc = &noop_qdisc;
> +
>  	err = tcf_block_get(&q->block, &q->filter_list, sch, extack);
>  	if (err)
>  		return err;
> -
> -	q->qdisc = &noop_qdisc;
>  	return sfb_change(sch, opt, extack);
>  }
>  
> 

It seems a similar fix would be needed in net/sched/sch_dsmark.c ?