netdev - [PATCH net-next v2 0/1] linkwatch use-after-free fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <cover.1655024266.git.lukas@wunner.de>
Date:   Sun, 12 Jun 2022 11:07:46 +0200
From:   Lukas Wunner <lukas@...ner.de>
To:     Oliver Neukum <oneukum@...e.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, Jann Horn <jannh@...gle.com>,
        Oleksij Rempel <o.rempel@...gutronix.de>,
        Oleksij Rempel <linux@...pel-privat.de>,
        Eric Dumazet <edumazet@...gle.com>
Cc:     netdev@...r.kernel.org, linux-usb@...r.kernel.org,
        Andrew Lunn <andrew@...n.ch>,
        Jacky Chou <jackychou@...x.com.tw>, Willy Tarreau <w@....eu>,
        Lino Sanfilippo <LinoSanfilippo@....de>,
        Philipp Rosenberger <p.rosenberger@...bus.com>,
        Heiner Kallweit <hkallweit1@...il.com>
Subject: [PATCH net-next v2 0/1] linkwatch use-after-free fix

Discussion on v1 of this patch fizzled out in April without it being applied:

https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/#r

This is a vulnerability, we can't just ignore it.  Paolo Abeni asked
me to explore whether the issue can be fixed in USB Ethernet drivers
instead of core networking code.  I've done that and presented a patch,
but consider it an inferior approach.

I'm explaining why in the updated commit message of this patch and
I'm rebasing it on net-next.  Otherwise it's the same as v1,  I still
believe that this is the best solution to the problem.

Thanks!

Lukas Wunner (1):
  net: linkwatch: ignore events for unregistered netdevs

 net/core/dev.c        | 17 -----------------
 net/core/dev.h        |  1 -
 net/core/link_watch.c | 10 ++--------
 3 files changed, 2 insertions(+), 26 deletions(-)

-- 
2.35.2