netdev - Re: [PATCH v4 0/3] Fix several use after free bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 20 Jan 2021 13:34:38 +0100
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     Vincent Mailhol <mailhol.vincent@...adoo.fr>,
        Oliver Hartkopp <socketcan@...tkopp.net>,
        linux-can@...r.kernel.org
Cc:     netdev@...r.kernel.org, Wolfgang Grandegger <wg@...ndegger.com>,
        Stephane Grosjean <s.grosjean@...k-system.com>,
        Loris Fauster <loris.fauster@...ontrol.com>,
        Alejandro Concepcion Rodriguez <alejandro@...ro.eu>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: Re: [PATCH v4 0/3] Fix several use after free bugs

On 1/20/21 12:41 PM, Vincent Mailhol wrote:
> This series fix three bugs which all have the same root cause.
> 
> When calling netif_rx(skb) and its variants, the skb will eventually
> get consumed (or freed) and thus it is unsafe to dereference it after
> the call returns.
> 
> This remark especially applies to any variable with aliases the skb
> memory which is the case of the can(fd)_frame.
> 
> The pattern is as this:
>     skb = alloc_can_skb(dev, &cf);
>     /* Do stuff */
>     netif_rx(skb);
>     stats->rx_bytes += cf->len;
> 
> Increasing the stats should be done *before* the call to netif_rx()
> while the skb is still safe to use.
> 
> Changes since v3:
>   - Patch 1/3: move the comments for upstream after the --- scissors
> 
> Changes since v2:
>   - rebase on net/master
>   - Patch 1/3: Added a comment towards upstream to inform about a
>     conflict which will occur when net-next and net are merged
> Ref: https://lore.kernel.org/linux-can/20210120085356.m7nabbw5zhy7prpo@hardanger.blackshift.org/
> 
> Changes since v1:
>   - fix a silly typo in patch 2/3 (variable len was declared twice...)
> 
> Vincent Mailhol (3):
>   can: dev: can_restart: fix use after free bug
>   can: vxcan: vxcan_xmit: fix use after free bug
>   can: peak_usb: fix use after free bugs
> 
>  drivers/net/can/dev.c                      | 4 ++--
>  drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++----
>  drivers/net/can/vxcan.c                    | 6 ++++--
>  3 files changed, 10 insertions(+), 8 deletions(-)

Applied to linux-can-testing. I don't know why 2/3 hasn't made it to the mail
archive yet.

Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |



Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)