netdev - Re: [PATCH v4] net: rose: fix null-ptr-deref caused by rose_kill_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 2 Jul 2022 15:23:57 +0800 (GMT+08:00)
From:   duoming@....edu.cn
To:     "Jakub Kicinski" <kuba@...nel.org>
Cc:     linux-hams@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, ralf@...ux-mips.org,
        davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com
Subject: Re: [PATCH v4] net: rose: fix null-ptr-deref caused by
 rose_kill_by_neigh

Hello,

On Fri, 1 Jul 2022 19:41:55 -0700 Jakub Kicinski wrote:

> On Wed, 29 Jun 2022 18:49:41 +0800 Duoming Zhou wrote:
> > When the link layer connection is broken, the rose->neighbour is
> > set to null. But rose->neighbour could be used by rose_connection()
> > and rose_release() later, because there is no synchronization among
> > them. As a result, the null-ptr-deref bugs will happen.
> > 
> > One of the null-ptr-deref bugs is shown below:
> > 
> >     (thread 1)                  |        (thread 2)
> >                                 |  rose_connect
> > rose_kill_by_neigh              |    lock_sock(sk)
> >   spin_lock_bh(&rose_list_lock) |    if (!rose->neighbour)
> >   rose->neighbour = NULL;//(1)  |
> >                                 |    rose->neighbour->use++;//(2)
> 
> >  		if (rose->neighbour == neigh) {
> 
> Why is it okay to perform this comparison without the socket lock,
> if we need a socket lock to clear it? Looks like rose_kill_by_neigh()
> is not guaranteed to clear all the uses of a neighbor.

I am sorry, the comparision should also be protected with socket lock.
The rose_kill_by_neigh() only clear the neighbor that is passed as
parameter of rose_kill_by_neigh(). 

> > +			sock_hold(s);
> > +			spin_unlock_bh(&rose_list_lock);
> > +			lock_sock(s);
> >  			rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
> >  			rose->neighbour->use--;
> 
> What protects the use counter?

The use coounter is protected by socket lock.

> >  			rose->neighbour = NULL;
> > +			release_sock(s);
> > +			spin_lock_bh(&rose_list_lock);
> 
> Don't take the lock here just dump one line further back.

Ok, I will dump one line further back.

Best regards,
Duoming Zhou