netdev - Re: [PATCH net] l2tp: add sk_reuseport checks to l2tp_validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 06 Jul 2020 12:45:36 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     jchapman@...alix.com
Cc:     netdev@...r.kernel.org, gnault@...hat.com
Subject: Re: [PATCH net] l2tp: add sk_reuseport checks to
 l2tp_validate_socket

From: James Chapman <jchapman@...alix.com>
Date: Mon, 6 Jul 2020 13:12:59 +0100

> The crash occurs in the socket destroy path. bpf_sk_reuseport_detach
> assumes ownership of sk_user_data if sk_reuseport is set and writes a
> NULL pointer to the memory pointed to by
> sk_user_data. bpf_sk_reuseport_detach is called via
> udp_lib_unhash. l2tp does its socket cleanup through sk_destruct,
> which fetches private data through sk_user_data. The BUG_ON fires
> because this data has been corrupted.

The ownership of sk_user_data has to be handled more cleanly.

BPF really has no business taking over this as it is for the protocols
to use and what L2TP is doing is quite natural and normal.  Exactly
what sk_user_data was designed to be used for.

I'm not applying this, please take this up with the BPF folks.  They
need to store their metadata elsewhere.