netdev - Re: net: ipv6: raw: fixes null pointer deference in rawv6_push_pending

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y7vm00H/+oVXqsya@gondor.apana.org.au>
Date:   Mon, 9 Jan 2023 18:05:07 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     Kyle Zeng <zengyhkyle@...il.com>, Jakub Kicinski <kuba@...nel.org>,
        davem@...emloft.net, yoshfuji@...ux-ipv6.org, dsahern@...nel.org,
        pabeni@...hat.com, netdev@...r.kernel.org
Subject: Re: net: ipv6: raw: fixes null pointer deference in
 rawv6_push_pending_frames

On Mon, Jan 09, 2023 at 09:45:14AM +0100, Eric Dumazet wrote:
> 
> OK, but it seems we would be in an error condition, and would need to
> purge sk_write_queue ?

No the bug is elsewhere.  We already checked whether the offset
is valid at the top of the function:

	total_len = inet_sk(sk)->cork.base.length;
	if (offset >= total_len - 1) {
		err = -EINVAL;
		ip6_flush_pending_frames(sk);
		goto out;
	}

So we should figure out why the socket cork queue contains less
data than it claims.

Do we have a reproducer?

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt