netdev - Re: [PATCH bpf 1/2] bpf: Fix too early release of tcx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: 
 <172047783313.17442.16042215164463451364.git-patchwork-notify@kernel.org>
Date: Mon, 08 Jul 2024 22:30:33 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Daniel Borkmann <daniel@...earbox.net>
Cc: martin.lau@...nel.org, bpf@...r.kernel.org, netdev@...r.kernel.org,
 xten@...c.io, v4bel@...ori.io, qwerty@...ori.io
Subject: Re: [PATCH bpf 1/2] bpf: Fix too early release of tcx_entry

Hello:

This series was applied to bpf/bpf.git (master)
by Martin KaFai Lau <martin.lau@...nel.org>:

On Mon,  8 Jul 2024 15:31:29 +0200 you wrote:
> Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported
> an issue that the tcx_entry can be released too early leading to a use
> after free (UAF) when an active old-style ingress or clsact qdisc with a
> shared tc block is later replaced by another ingress or clsact instance.
> 
> Essentially, the sequence to trigger the UAF (one example) can be as follows:
> 
> [...]

Here is the summary with links:
  - [bpf,1/2] bpf: Fix too early release of tcx_entry
    https://git.kernel.org/bpf/bpf/c/1cb6f0bae504
  - [bpf,2/2] selftests/bpf: Extend tcx tests to cover late tcx_entry release
    https://git.kernel.org/bpf/bpf/c/5f1d18de7918

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html