* [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
@ 2017-12-04 21:02 simo.ghannam
2017-12-04 22:02 ` Eric Dumazet
2017-12-05 19:55 ` David Miller
0 siblings, 2 replies; 7+ messages in thread
From: simo.ghannam @ 2017-12-04 21:02 UTC (permalink / raw)
To: netdev; +Cc: Mohamed Ghannam
From: Mohamed Ghannam <simo.ghannam@gmail.com>
Whenever the sock object is in DCCP_CLOSED state, dccp_disconnect() must free
dccps_hc_tx_ccid and dccps_hc_rx_ccid and set to NULL.
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
---
net/dccp/proto.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b68168f..9d43c1f 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)
{
struct inet_connection_sock *icsk = inet_csk(sk);
struct inet_sock *inet = inet_sk(sk);
+ struct dccp_sock *dp = dccp_sk(sk);
int err = 0;
const int old_state = sk->sk_state;
@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)
sk->sk_err = ECONNRESET;
dccp_clear_xmit_timers(sk);
+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ dp->dccps_hc_rx_ccid = NULL;
+ dp->dccps_hc_tx_ccid = NULL;
__skb_queue_purge(&sk->sk_receive_queue);
__skb_queue_purge(&sk->sk_write_queue);
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
2017-12-04 21:02 [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code simo.ghannam
@ 2017-12-04 22:02 ` Eric Dumazet
2017-12-05 19:55 ` David Miller
1 sibling, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2017-12-04 22:02 UTC (permalink / raw)
To: simo.ghannam, netdev
On Mon, 2017-12-04 at 22:02 +0100, simo.ghannam@gmail.com wrote:
> From: Mohamed Ghannam <simo.ghannam@gmail.com>
>
> Whenever the sock object is in DCCP_CLOSED state,
> dccp_disconnect() must free
> dccps_hc_tx_ccid and dccps_hc_rx_ccid and set to NULL.
>
> Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
> ---
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
[not found] <1512421326-57291-1-git-send-email-simo.ghannam>
@ 2017-12-04 22:08 ` simo.ghannam
2017-12-05 20:58 ` simo.ghannam
1 sibling, 0 replies; 7+ messages in thread
From: simo.ghannam @ 2017-12-04 22:08 UTC (permalink / raw)
To: netdev; +Cc: Mohamed Ghannam
From: Mohamed Ghannam <simo.ghannam@gmail.com>
Whenever the sock object is in DCCP_CLOSED state,
dccp_disconnect() must free dccps_hc_tx_ccid and
dccps_hc_rx_ccid and set to NULL.
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
---
net/dccp/proto.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b68168f..9d43c1f 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)
{
struct inet_connection_sock *icsk = inet_csk(sk);
struct inet_sock *inet = inet_sk(sk);
+ struct dccp_sock *dp = dccp_sk(sk);
int err = 0;
const int old_state = sk->sk_state;
@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)
sk->sk_err = ECONNRESET;
dccp_clear_xmit_timers(sk);
+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ dp->dccps_hc_rx_ccid = NULL;
+ dp->dccps_hc_tx_ccid = NULL;
__skb_queue_purge(&sk->sk_receive_queue);
__skb_queue_purge(&sk->sk_write_queue);
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
2017-12-04 21:02 [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code simo.ghannam
2017-12-04 22:02 ` Eric Dumazet
@ 2017-12-05 19:55 ` David Miller
1 sibling, 0 replies; 7+ messages in thread
From: David Miller @ 2017-12-05 19:55 UTC (permalink / raw)
To: simo.ghannam; +Cc: netdev
From: simo.ghannam@gmail.com
Date: Mon, 4 Dec 2017 22:02:06 +0100
> From: Mohamed Ghannam <simo.ghannam@gmail.com>
>
> Whenever the sock object is in DCCP_CLOSED state, dccp_disconnect() must free
> dccps_hc_tx_ccid and dccps_hc_rx_ccid and set to NULL.
>
> Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Please eliminate this weird indentation in your commit messages.
The text should be adjustest fully to the leftmost column with
no unnecessary whitepsace.
Thank you.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
[not found] <1512421326-57291-1-git-send-email-simo.ghannam>
2017-12-04 22:08 ` simo.ghannam
@ 2017-12-05 20:58 ` simo.ghannam
2017-12-05 21:02 ` Eric Dumazet
2017-12-05 23:09 ` David Miller
1 sibling, 2 replies; 7+ messages in thread
From: simo.ghannam @ 2017-12-05 20:58 UTC (permalink / raw)
To: netdev; +Cc: Mohamed Ghannam
From: Mohamed Ghannam <simo.ghannam@gmail.com>
Whenever the sock object is in DCCP_CLOSED state,
dccp_disconnect() must free dccps_hc_tx_ccid and
dccps_hc_rx_ccid and set to NULL.
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
---
net/dccp/proto.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b68168f..9d43c1f 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)
{
struct inet_connection_sock *icsk = inet_csk(sk);
struct inet_sock *inet = inet_sk(sk);
+ struct dccp_sock *dp = dccp_sk(sk);
int err = 0;
const int old_state = sk->sk_state;
@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)
sk->sk_err = ECONNRESET;
dccp_clear_xmit_timers(sk);
+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ dp->dccps_hc_rx_ccid = NULL;
+ dp->dccps_hc_tx_ccid = NULL;
__skb_queue_purge(&sk->sk_receive_queue);
__skb_queue_purge(&sk->sk_write_queue);
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
2017-12-05 20:58 ` simo.ghannam
@ 2017-12-05 21:02 ` Eric Dumazet
2017-12-05 23:09 ` David Miller
1 sibling, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2017-12-05 21:02 UTC (permalink / raw)
To: simo.ghannam, netdev
On Tue, 2017-12-05 at 20:58 +0000, simo.ghannam@gmail.com wrote:
> From: Mohamed Ghannam <simo.ghannam@gmail.com>
>
> Whenever the sock object is in DCCP_CLOSED state,
> dccp_disconnect() must free dccps_hc_tx_ccid and
> dccps_hc_rx_ccid and set to NULL.
>
> Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
> ---
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
2017-12-05 20:58 ` simo.ghannam
2017-12-05 21:02 ` Eric Dumazet
@ 2017-12-05 23:09 ` David Miller
1 sibling, 0 replies; 7+ messages in thread
From: David Miller @ 2017-12-05 23:09 UTC (permalink / raw)
To: simo.ghannam; +Cc: netdev
From: simo.ghannam@gmail.com
Date: Tue, 5 Dec 2017 20:58:35 +0000
> From: Mohamed Ghannam <simo.ghannam@gmail.com>
>
> Whenever the sock object is in DCCP_CLOSED state,
> dccp_disconnect() must free dccps_hc_tx_ccid and
> dccps_hc_rx_ccid and set to NULL.
>
> Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2017-12-05 23:09 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-12-04 21:02 [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code simo.ghannam
2017-12-04 22:02 ` Eric Dumazet
2017-12-05 19:55 ` David Miller
[not found] <1512421326-57291-1-git-send-email-simo.ghannam>
2017-12-04 22:08 ` simo.ghannam
2017-12-05 20:58 ` simo.ghannam
2017-12-05 21:02 ` Eric Dumazet
2017-12-05 23:09 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).