netdev - Re: [PATCH v2] can: fix skb reference counting in j1939_session

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z0nAtXNSaVaJTiLu@pengutronix.de>
Date: Fri, 29 Nov 2024 14:25:09 +0100
From: Oleksij Rempel <o.rempel@...gutronix.de>
To: Jiri Pirko <jiri@...nulli.us>
Cc: Dmitry Antipov <dmantipov@...dex.ru>,
	Robin van der Gracht <robin@...tonic.nl>,
	Oliver Hartkopp <socketcan@...tkopp.net>,
	Marc Kleine-Budde <mkl@...gutronix.de>, linux-can@...r.kernel.org,
	netdev@...r.kernel.org, lvc-project@...uxtesting.org,
	syzbot+d4e8dc385d9258220c31@...kaller.appspotmail.com
Subject: Re: [PATCH v2] can: fix skb reference counting in j1939_session_new()

On Wed, Nov 06, 2024 at 10:43:04AM +0100, Oleksij Rempel wrote:
> On Tue, Nov 05, 2024 at 05:37:53PM +0100, Jiri Pirko wrote:
> > Tue, Nov 05, 2024 at 10:48:23AM CET, dmantipov@...dex.ru wrote:
> > >Since 'j1939_session_skb_queue()' do an extra 'skb_get()' for each
> > >new skb, I assume that the same should be done for an initial one
> > 
> > It is odd to write "I assume" for fix like this. You should know for
> > sure, don't you?
> 
> Hm... looks the there is more then one refcounting problem at this
> point. skb_queue is set from 3 different paths, with resulting 3 different
> refcount states:
> 
> j1939_sk_send_loop()
>   skb = j1939_sk_alloc_skb() // skb with refcount == 1
>   if (!session) {
>     session = j1939_tp_send(priv, skb, size)
>        ... 
>        session = j1939_session_new(priv, skb, size);
>           skb_queue_tail(&session->skb_queue, skb); // skb refcount == 1
>           
>   } else {
>     j1939_session_skb_queue(session, skb);
>       // here, skb is refcounted
>       skb_queue_tail(&session->skb_queue, skb_get(skb)); // skb refcount == 2
>   }
>   
>   // at the end of function, skb refcount == 1 or 2
>      
> j1939_xtp_rx_rts_session_new()
>   j1939_session_fresh_new()
>     skb = alloc_skb() // skb with refcount == 1
>     session = j1939_session_new(priv, skb, size);
>        skb_queue_tail(&session->skb_queue, skb);
>     skb_put(skb, size); // skb with refcount == 0
> 
> I agree with this patch, but there is missing skb_put() in j1939_sk_send_loop()

Please forget it, no skb_free is needed in the j1939_sk_send_loop().

Regards,
Oleksij
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |