lkml.org 
[lkml]   [2022]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v4] net: rose: fix null-ptr-deref caused by rose_kill_by_neigh
On Wed, 29 Jun 2022 18:49:41 +0800 Duoming Zhou wrote:
> When the link layer connection is broken, the rose->neighbour is
> set to null. But rose->neighbour could be used by rose_connection()
> and rose_release() later, because there is no synchronization among
> them. As a result, the null-ptr-deref bugs will happen.
>
> One of the null-ptr-deref bugs is shown below:
>
> (thread 1) | (thread 2)
> | rose_connect
> rose_kill_by_neigh | lock_sock(sk)
> spin_lock_bh(&rose_list_lock) | if (!rose->neighbour)
> rose->neighbour = NULL;//(1) |
> | rose->neighbour->use++;//(2)

> if (rose->neighbour == neigh) {

Why is it okay to perform this comparison without the socket lock,
if we need a socket lock to clear it? Looks like rose_kill_by_neigh()
is not guaranteed to clear all the uses of a neighbor.

> + sock_hold(s);
> + spin_unlock_bh(&rose_list_lock);
> + lock_sock(s);
> rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
> rose->neighbour->use--;

What protects the use counter?

> rose->neighbour = NULL;
> + release_sock(s);
> + spin_lock_bh(&rose_list_lock);

Don't take the lock here just dump one line further back.

> + sock_put(s);
> + goto again;
> }
> }
> spin_unlock_bh(&rose_list_lock);
> diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
> index fee6409c2bb..b116828b422 100644
> --- a/net/rose/rose_route.c
> +++ b/net/rose/rose_route.c
> @@ -827,7 +827,9 @@ void rose_link_failed(ax25_cb *ax25, int reason)
> ax25_cb_put(ax25);
>
> rose_del_route_by_neigh(rose_neigh);
> + spin_unlock_bh(&rose_neigh_list_lock);
> rose_kill_by_neigh(rose_neigh);
> + return;
> }
> spin_unlock_bh(&rose_neigh_list_lock);
> }

\
 
 \ /
  Last update: 2022-07-02 04:43    [W:0.115 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site