Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock

Path	csiph.com!news.mixmin.net!weretis.net!feeder4.news.weretis.net!storethat.news.telefonica.de!telefonica.de!news.panservice.it!bofh.it!news.nic.it!robomod
From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock
Date	Tue, 22 Dec 2015 21:40:02 +0100
Message-ID	<qIBSV-e4-5@gated-at.bofh.it> (permalink)
References	<qHTfc-5yd-7@gated-at.bofh.it>
X-Original-To	vegard.nossum@oracle.com
X-Mailer	Mew version 6.6 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO)
MIME-Version	1.0
Content-Type	Text/Plain; charset=us-ascii
Content-Transfer-Encoding	7bit
X-Greylist	Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 22 Dec 2015 12:34:26 -0800 (PST)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	23
Organization	linux.* mail to news gateway
X-Original-Cc	acme@kernel.org, edumazet@google.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org
X-Original-Date	Tue, 22 Dec 2015 15:34:25 -0500 (EST)
X-Original-Message-ID	<20151222.153425.727988801786072877.davem@davemloft.net>
X-Original-References	<1450644807-852-1-git-send-email-vegard.nossum@oracle.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1297056

Show key headers only | View raw

From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Sun, 20 Dec 2015 21:53:27 +0100

> @@ -115,6 +115,10 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
>  		newdp->dccps_isr = dreq->dreq_isr;
>  		newdp->dccps_gsr = dreq->dreq_gsr;
>  
> +		newdp->dccps_hc_rx_ackvec = NULL;
> +		newdp->dccps_hc_rx_ccid = NULL;
> +		newdp->dccps_hc_tx_ccid = NULL;

->dccps_hc_rx_ackvec is set to NULL several lines above this, so you don't
need to add that case here.

WRT the ccid pointers, I don't think we can just NULL them out.

If the parent socket has these CCID features enabled, we have to
clone them into the child somehow.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] dccp: fix use-after-free after cloning struct dccp_sock Vegard Nossum <vegard.nossum@oracle.com> - 2015-12-20 22:00 +0100
  Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock David Miller <davem@davemloft.net> - 2015-12-22 21:40 +0100

csiph-web