From: Miquel Raynal <miquel.raynal@bootlin•com>
To: Ignat Korchagin <ignat@cloudflare•com>
Cc: "David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
netdev@vger•kernel.org, linux-kernel@vger•kernel.org,
Marcel Holtmann <marcel@holtmann•org>,
Johan Hedberg <johan.hedberg@gmail•com>,
Luiz Augusto von Dentz <luiz.dentz@gmail•com>,
Oliver Hartkopp <socketcan@hartkopp•net>,
Marc Kleine-Budde <mkl@pengutronix•de>,
Alexander Aring <alex.aring@gmail•com>,
Stefan Schmidt <stefan@datenfreihafen•org>,
David Ahern <dsahern@kernel•org>,
Willem de Bruijn <willemdebruijn.kernel@gmail•com>,
linux-bluetooth@vger•kernel.org, linux-can@vger•kernel.org,
linux-wpan@vger•kernel.org, kernel-team@cloudflare•com,
kuniyu@amazon•com, alibuda@linux•alibaba.com
Subject: Re: [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
Date: Tue, 8 Oct 2024 10:12:32 +0200 [thread overview]
Message-ID: <20241008101232.123389e1@xps-13> (raw)
In-Reply-To: <20241007213502.28183-7-ignat@cloudflare.com>
Hi Ignat,
ignat@cloudflare•com wrote on Mon, 7 Oct 2024 22:35:00 +0100:
> sock_init_data() attaches the allocated sk object to the provided sock
> object. If ieee802154_create() fails later, the allocated sk object is
> freed, but the dangling pointer remains in the provided sock object, which
> may allow use-after-free.
>
> Clear the sk pointer in the sock object on error.
>
> Signed-off-by: Ignat Korchagin <ignat@cloudflare•com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin•com>
Thanks,
Miquèl
next prev parent reply other threads:[~2024-10-08 8:12 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-07 21:34 [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 1/8] net: explicitly clear the sk pointer, when pf->create fails Ignat Korchagin
2024-10-07 21:47 ` Kuniyuki Iwashima
2024-10-08 0:20 ` Jakub Kicinski
2024-10-07 21:34 ` [PATCH v2 2/8] af_packet: avoid erroring out after sock_init_data() in packet_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 3/8] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 4/8] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 5/8] net: af_can: do not leave a dangling sk pointer in can_create() Ignat Korchagin
2024-10-08 2:37 ` Vincent MAILHOL
2024-10-08 6:52 ` Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() Ignat Korchagin
2024-10-08 8:12 ` Miquel Raynal [this message]
2024-10-07 21:35 ` [PATCH v2 7/8] net: inet: do not leave a dangling sk pointer in inet_create() Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 8/8] inet6: do not leave a dangling sk pointer in inet6_create() Ignat Korchagin
2024-10-07 21:57 ` [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241008101232.123389e1@xps-13 \
--to=miquel.raynal@bootlin$(echo .)com \
--cc=alex.aring@gmail$(echo .)com \
--cc=alibuda@linux$(echo .)alibaba.com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=ignat@cloudflare$(echo .)com \
--cc=johan.hedberg@gmail$(echo .)com \
--cc=kernel-team@cloudflare$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@amazon$(echo .)com \
--cc=linux-bluetooth@vger$(echo .)kernel.org \
--cc=linux-can@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-wpan@vger$(echo .)kernel.org \
--cc=luiz.dentz@gmail$(echo .)com \
--cc=marcel@holtmann$(echo .)org \
--cc=mkl@pengutronix$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=socketcan@hartkopp$(echo .)net \
--cc=stefan@datenfreihafen$(echo .)org \
--cc=willemdebruijn.kernel@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox