lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ddce0e77-2fba-716f-6a69-eeb148fe91ca@canonical.com> Date: Sun, 16 Jan 2022 17:50:13 +0100 From: Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com> To: Hillf Danton <hdanton@...a.com> Cc: linux-nfc@...ts.01.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, syzbot+7f23bcddf626e0593a39@...kaller.appspotmail.com Subject: Re: [PATCH 1/7] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() On 16/01/2022 14:41, Hillf Danton wrote: > Hey Krzysztof > > On Sat, 15 Jan 2022 13:26:44 +0100 Krzysztof Kozlowski wrote: >> +++ b/net/nfc/llcp_sock.c >> @@ -789,6 +789,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, >> >> lock_sock(sk); >> >> + if (!llcp_sock->local) { >> + release_sock(sk); >> + return -ENODEV; >> + } >> + >> if (sk->sk_type == SOCK_DGRAM) { >> DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, >> msg->msg_name); >> -- >> 2.32.0 > > Given the same check for llcp local in nfc_llcp_send_ui_frame(), adding > another check does not help. Helps, because other is not protected with lock. The other could be removed, because it is simply wrong, but I did not check it. The patch fixes the report and reproducible race, but maybe does not necessarily fix entirely the race (which maybe this is what you meant by "does not help"?). Best regards, Krzysztof
Powered by blists - more mailing lists