From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Ignat Korchagin <ignat@cloudflare.com>
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@gmail.com>,
Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
Oliver Hartkopp <socketcan@hartkopp.net>,
Marc Kleine-Budde <mkl@pengutronix.de>,
Alexander Aring <alex.aring@gmail.com>,
Stefan Schmidt <stefan@datenfreihafen.org>,
David Ahern <dsahern@kernel.org>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org,
linux-wpan@vger.kernel.org, kernel-team@cloudflare.com,
kuniyu@amazon.com, alibuda@linux.alibaba.com
Subject: Re: [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
Date: Tue, 8 Oct 2024 10:12:32 +0200 [thread overview]
Message-ID: <20241008101232.123389e1@xps-13> (raw)
In-Reply-To: <20241007213502.28183-7-ignat@cloudflare.com>
Hi Ignat,
ignat@cloudflare.com wrote on Mon, 7 Oct 2024 22:35:00 +0100:
> sock_init_data() attaches the allocated sk object to the provided sock
> object. If ieee802154_create() fails later, the allocated sk object is
> freed, but the dangling pointer remains in the provided sock object, which
> may allow use-after-free.
>
> Clear the sk pointer in the sock object on error.
>
> Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Thanks,
Miquèl
next prev parent reply other threads:[~2024-10-08 8:12 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-07 21:34 [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 1/8] net: explicitly clear the sk pointer, when pf->create fails Ignat Korchagin
2024-10-07 21:47 ` Kuniyuki Iwashima
2024-10-08 0:20 ` Jakub Kicinski
2024-10-07 21:34 ` [PATCH v2 2/8] af_packet: avoid erroring out after sock_init_data() in packet_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 3/8] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 4/8] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 5/8] net: af_can: do not leave a dangling sk pointer in can_create() Ignat Korchagin
2024-10-08 2:37 ` Vincent MAILHOL
2024-10-08 6:52 ` Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() Ignat Korchagin
2024-10-08 8:12 ` Miquel Raynal [this message]
2024-10-07 21:35 ` [PATCH v2 7/8] net: inet: do not leave a dangling sk pointer in inet_create() Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 8/8] inet6: do not leave a dangling sk pointer in inet6_create() Ignat Korchagin
2024-10-07 21:57 ` [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241008101232.123389e1@xps-13 \
--to=miquel.raynal@bootlin.com \
--cc=alex.aring@gmail.com \
--cc=alibuda@linux.alibaba.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=ignat@cloudflare.com \
--cc=johan.hedberg@gmail.com \
--cc=kernel-team@cloudflare.com \
--cc=kuba@kernel.org \
--cc=kuniyu@amazon.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wpan@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=socketcan@hartkopp.net \
--cc=stefan@datenfreihafen.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).