netdev - Re: [PATCH net 3/3] net/smc: Fix af_ops of child socket pointing to released memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220411083845.GA31900@e02h04389.eu6sqa>
Date:   Mon, 11 Apr 2022 16:38:45 +0800
From:   "D. Wythe" <alibuda@...ux.alibaba.com>
To:     Karsten Graul <kgraul@...ux.ibm.com>
Cc:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        linux-s390@...r.kernel.org, Heiko Carstens <hca@...ux.ibm.com>
Subject: Re: [PATCH net 3/3] net/smc: Fix af_ops of child socket pointing to
 released memory

On Fri, Apr 08, 2022 at 05:10:35PM +0200, Karsten Graul wrote:
> Child sockets may inherit the af_ops from the parent listen socket.
> When the listen socket is released then the af_ops of the child socket
> points to released memory.
> Solve that by restoring the original af_ops for child sockets which
> inherited the parent af_ops. And clear any inherited user_data of the
> parent socket.
> 
> Fixes: 8270d9c21041 ("net/smc: Limit backlog connections")
> Reviewed-by: Wenjia Zhang <wenjia@...ux.ibm.com>
> Signed-off-by: Karsten Graul <kgraul@...ux.ibm.com>
> ---
>  net/smc/af_smc.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index f0d118e9f155..14ddc40149e8 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
>  					  bool *own_req)
>  {
>  	struct smc_sock *smc;
> +	struct sock *child;
>  
>  	smc = smc_clcsock_user_data(sk);
>  
> @@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
>  	}
>  
>  	/* passthrough to original syn recv sock fct */
> -	return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
> -					      own_req);
> +	child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
> +					       own_req);
> +	/* child must not inherit smc or its ops */
> +	if (child) {
> +		rcu_assign_sk_user_data(child, NULL);
> +
> +		/* v4-mapped sockets don't inherit parent ops. Don't restore. */
> +		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
> +			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
> +	}
> +	return child;
>  
>  drop:
>  	dst_release(dst);
> -- 
> 2.32.0

My bad, LGTM, Thanks for your fix.

Reviewed-by: D. Wythe <alibuda@...ux.alibaba.com>