netdev - Re: [PATCH net v2 0/2] bonding: fix NULL deref in bond_rr_gen_slave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <29846.1663696436@famine>
Date:   Tue, 20 Sep 2022 10:53:56 -0700
From:   Jay Vosburgh <jay.vosburgh@...onical.com>
To:     Jonathan Toppins <jtoppins@...hat.com>
cc:     "netdev @ vger . kernel . org" <netdev@...r.kernel.org>,
        Jussi Maki <joamaki@...il.com>
Subject: Re: [PATCH net v2 0/2] bonding: fix NULL deref in bond_rr_gen_slave_id

Jonathan Toppins <jtoppins@...hat.com> wrote:

>Fix a NULL dereference of the struct bonding.rr_tx_counter member because
>if a bond is initially created with an initial mode != zero (Round Robin)
>the memory required for the counter is never created and when the mode is
>changed there is never any attempt to verify the memory is allocated upon
>switching modes.
>
>The first patch provides a selftest to demonstrate the issue and the
>second patch fixes the issue.
>
>Jonathan Toppins (2):
>  selftests: bonding: cause oops in bond_rr_gen_slave_id
>  bonding: fix NULL deref in bond_rr_gen_slave_id

	For the series:

Acked-by: Jay Vosburgh <jay.vosburgh@...onical.com>


> drivers/net/bonding/bond_main.c               | 15 +++---
> .../selftests/drivers/net/bonding/Makefile    |  3 +-
> .../bonding/bond-arp-interval-causes-panic.sh | 49 +++++++++++++++++++
> 3 files changed, 57 insertions(+), 10 deletions(-)
> create mode 100755 tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh
>
>-- 
>2.31.1
>