Re: [PATCH] net: Fix potential NULL pointer dereference in __skb_try_recv_datagram

From	Jacob Siverskog <jacob@teenage.engineering>
Newsgroups	linux.kernel
Subject	Re: [PATCH] net: Fix potential NULL pointer dereference in __skb_try_recv_datagram
Date	2016-01-20 17:20 +0100
Message-ID	<qT3Ee-yP-11@gated-at.bofh.it> (permalink)
References	(10 earlier) <qNACT-3VY-17@gated-at.bofh.it> <qNAWe-43s-3@gated-at.bofh.it> <qNB5U-480-17@gated-at.bofh.it> <qT2yu-8hL-7@gated-at.bofh.it> <qT3bb-7a-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Jan 20, 2016 at 4:48 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Wed, 2016-01-20 at 16:06 +0100, Jacob Siverskog wrote:
>> On Tue, Jan 5, 2016 at 3:39 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>> > On Tue, 2016-01-05 at 15:34 +0100, Jacob Siverskog wrote:
>> >> On Tue, Jan 5, 2016 at 3:14 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>> >
>> >> >
>> >> > You might build a kernel with KASAN support to get maybe more chances to
>> >> > trigger the bug.
>> >> >
>> >> > ( https://www.kernel.org/doc/Documentation/kasan.txt )
>> >> >
>> >>
>> >> Ah. Doesn't seem to be supported on arm(32) unfortunately.
>> >
>> > Then you could at least use standard debugging features :
>> >
>> > CONFIG_SLAB=y
>> > CONFIG_SLABINFO=y
>> > CONFIG_DEBUG_SLAB=y
>> > CONFIG_DEBUG_SLAB_LEAK=y
>> >
>> > (Or equivalent SLUB options)
>> >
>> > and
>> >
>> > CONFIG_DEBUG_PAGEALLOC=y
>> >
>> > (If arm(32) has CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y)
>>
>> I tried with those enabled and while toggling power on the Bluetooth
>> interface I usually get this after a few iterations:
>> kernel: Bluetooth: Unable to push skb to HCI core(-6)
>
> Well, this code seems to be quite buggy.
>
> I do not have time to audit it, but 5 minutes are enough to spot 2
> issues.
>
> skb, once given to another queue/layer should not be accessed anymore.
>

Ok. Unfortunately I still see the slab corruption even with your changes.

Thread

Re: [PATCH] net: Fix potential NULL pointer dereference in __skb_try_recv_datagram Jacob Siverskog <jacob@teenage.engineering> - 2016-01-20 16:10 +0100
  Re: [PATCH] net: Fix potential NULL pointer dereference in  __skb_try_recv_datagram Eric Dumazet <eric.dumazet@gmail.com> - 2016-01-20 16:50 +0100
    Re: [PATCH] net: Fix potential NULL pointer dereference in __skb_try_recv_datagram Jacob Siverskog <jacob@teenage.engineering> - 2016-01-20 17:20 +0100
      Re: [PATCH] net: Fix potential NULL pointer dereference in  __skb_try_recv_datagram Eric Dumazet <eric.dumazet@gmail.com> - 2016-01-20 18:10 +0100

csiph-web