netdev - Re: [PATCH net ver.2] genetlink: fix possible use-after-free and null-ptr-deref in genl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <61ba58b4-abc7-2b87-c25f-91ada2f28cfc@basealt.ru>
Date: Tue, 20 Feb 2024 14:03:55 +0300
From: kovalev@...linux.org
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: netdev@...r.kernel.org, pabeni@...hat.com, davem@...emloft.net,
 edumazet@...gle.com, kuba@...nel.org, jiri@...nulli.us,
 jacob.e.keller@...el.com, johannes@...solutions.net, idosch@...dia.com,
 horms@...nel.org, david.lebrun@...ouvain.be
Subject: Re: [PATCH net ver.2] genetlink: fix possible use-after-free and
 null-ptr-deref in genl_dumpit()

Hi Pablo,

20.02.2024 13:36, Pablo Neira Ayuso wrote:
> On Tue, Feb 20, 2024 at 01:25:12PM +0300, kovalev@...linux.org wrote:
>> From: Vasiliy Kovalev <kovalev@...linux.org>
>>
>> The pernet operations structure for the subsystem must be registered
>> before registering the generic netlink family.
> IIRC, you pointed to a syzbot report on genetlink similar to gtp.

Yes, I was referring to the link 
https://lore.kernel.org/all/0000000000007549a6060f99544d@google.com/T/ ,

>
> Maybe add that tag here and get the robot to test this fix?
but since the syzbot does not have a reproducer, I cannot say for sure 
that this is exactly the problem that this patch fixes, since syzbot 
refers to the tipc_udp_nl_dump_remoteip function and suddenly there is 
another problem...
>
> I'd suggest to describe the scenario, which is: There is a race that
> allows netlink dump and walking on pernet data while such pernet data
> is not yet set up.
>
> Thanks.

-- 
Regards,
Vasiliy Kovalev