Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock
Date	2015-12-22 21:40 +0100
Message-ID	<qIBSV-e4-5@gated-at.bofh.it> (permalink)
References	<qHTfc-5yd-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Sun, 20 Dec 2015 21:53:27 +0100

> @@ -115,6 +115,10 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
>  		newdp->dccps_isr = dreq->dreq_isr;
>  		newdp->dccps_gsr = dreq->dreq_gsr;
>  
> +		newdp->dccps_hc_rx_ackvec = NULL;
> +		newdp->dccps_hc_rx_ccid = NULL;
> +		newdp->dccps_hc_tx_ccid = NULL;

->dccps_hc_rx_ackvec is set to NULL several lines above this, so you don't
need to add that case here.

WRT the ccid pointers, I don't think we can just NULL them out.

If the parent socket has these CCID features enabled, we have to
clone them into the child somehow.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] dccp: fix use-after-free after cloning struct dccp_sock Vegard Nossum <vegard.nossum@oracle.com> - 2015-12-20 22:00 +0100
  Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock David Miller <davem@davemloft.net> - 2015-12-22 21:40 +0100

csiph-web