netdev - Re: [PATCH net 0/3] net/sched Bind logic fixes for cls_fw, cls_u32 and cls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8a707435884e18ccb92e1e91e474f7662d4f9365.camel@redhat.com>
Date: Tue, 25 Jul 2023 14:57:17 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: valis <sec@...is.email>, netdev@...r.kernel.org
Cc: jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us, 
 davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
 pctammela@...atatu.com,  victor@...atatu.com, ramdhan@...rlabs.sg,
 billy@...rlabs.sg
Subject: Re: [PATCH net 0/3] net/sched Bind logic fixes for cls_fw, cls_u32
 and cls_route

Hi,

On Fri, 2023-07-21 at 17:48 +0000, valis wrote:
> Three classifiers (cls_fw, cls_u32 and cls_route) always copy 
> tcf_result struct into the new instance of the filter on update.
> 
> This causes a problem when updating a filter bound to a class,
> as tcf_unbind_filter() is always called on the old instance in the 
> success path, decreasing filter_cnt of the still referenced class 
> and allowing it to be deleted, leading to a use-after-free.
> 
> This patch set fixes this issue in all affected classifiers by no longer
> copying the tcf_result struct from the old filter.
> 
> valis (3):
>   net/sched: cls_u32: No longer copy tcf_result on update to avoid
>     use-after-free
>   net/sched: cls_fw: No longer copy tcf_result on update to avoid
>     use-after-free
>   net/sched: cls_route: No longer copy tcf_result on update to avoid
>     use-after-free

The SoB in used here sounds really like a pseudonym, which in turn is
not explicitly forbidden by the the process, but a is IMHO a bit
borderline:

https://elixir.bootlin.com/linux/v6.4.5/source/Documentation/process/submitting-patches.rst#L415

@valis: could you please re-submit this using your a more
identificative account? You can retain the already collected acks.

Thanks!

Paolo
> 
>  net/sched/cls_fw.c    | 1 -
>  net/sched/cls_route.c | 1 -
>  net/sched/cls_u32.c   | 1 -
>  3 files changed, 3 deletions(-)
>