From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wout2-smtp.messagingengine.com ([64.147.123.25]:59687 "EHLO wout2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727246AbeIMMKs (ORCPT ); Thu, 13 Sep 2018 08:10:48 -0400 Date: Thu, 13 Sep 2018 09:02:36 +0200 From: Greg KH To: Tyler Hicks Cc: stable@vger.kernel.org Subject: Re: [PATCH 1/2] irda: Fix memory leak caused by repeated binds of irda socket Message-ID: <20180913070236.GD11496@kroah.com> References: <1536074645-14160-1-git-send-email-tyhicks@canonical.com> <1536074645-14160-2-git-send-email-tyhicks@canonical.com> <20180912193533.GC21563@kroah.com> <22c7e6a0-6a34-cbfb-8742-6dda5da245b6@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <22c7e6a0-6a34-cbfb-8742-6dda5da245b6@canonical.com> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Sep 12, 2018 at 03:49:16PM -0500, Tyler Hicks wrote: > On 09/12/2018 02:35 PM, Greg KH wrote: > > On Tue, Sep 04, 2018 at 03:24:04PM +0000, Tyler Hicks wrote: > >> The irda_bind() function allocates memory for self->ias_obj without > >> checking to see if the socket is already bound. A userspace process > >> could repeatedly bind the socket, have each new object added into the > >> LM-IAS database, and lose the reference to the old object assigned to > >> the socket to exhaust memory resources. This patch errors out of the > >> bind operation when self->ias_obj is already assigned. > >> > >> CVE-2018-6554 > >> > >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > >> Signed-off-by: Tyler Hicks > >> Reviewed-by: Seth Arnold > >> Reviewed-by: Stefan Bader > >> --- > > > > No "Reported-by:" lines? > > I always like to give credit with Reported-by tags but this was a rare > situation where the reporter didn't want to be acknowledged. Fair enough, I had to ask :) > > And agin, how can you trigger any of this given the code doesn't even > > work? Can you load irda modules as a "normal" user? > > I answered these questions in my other reply. The irda socket interface > works well enough to reach the affected code. Ok, thanks for the patches, I'll go queue them up everywhere now. greg k-h