netdev - Re: net: ipv6: raw: fixes null pointer deference in rawv6_push_pending

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 9 Jan 2023 11:08:08 +0100
From:   Eric Dumazet <edumazet@...gle.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     Kyle Zeng <zengyhkyle@...il.com>, Jakub Kicinski <kuba@...nel.org>,
        davem@...emloft.net, yoshfuji@...ux-ipv6.org, dsahern@...nel.org,
        pabeni@...hat.com, netdev@...r.kernel.org
Subject: Re: net: ipv6: raw: fixes null pointer deference in rawv6_push_pending_frames

On Mon, Jan 9, 2023 at 11:05 AM Herbert Xu <herbert@...dor.apana.org.au> wrote:
>
> On Mon, Jan 09, 2023 at 09:45:14AM +0100, Eric Dumazet wrote:
> >
> > OK, but it seems we would be in an error condition, and would need to
> > purge sk_write_queue ?
>
> No the bug is elsewhere.  We already checked whether the offset
> is valid at the top of the function:
>
>         total_len = inet_sk(sk)->cork.base.length;
>         if (offset >= total_len - 1) {
>                 err = -EINVAL;
>                 ip6_flush_pending_frames(sk);
>                 goto out;
>         }
>
> So we should figure out why the socket cork queue contains less
> data than it claims.
>
> Do we have a reproducer?

Kyle posted one in https://lore.kernel.org/netdev/Y7s%2FFofVXLwoVgWt@westworld/

Thanks.

>
> Thanks,
> --
> Email: Herbert Xu <herbert@...dor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt