public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed
From: Vlad Yasevich <vyasevich@gmail•com>
To: Marcelo <marcelo.leitner@gmail•com>,
	Eric Dumazet <eric.dumazet@gmail•com>
Cc: syzkaller <syzkaller@googlegroups•com>,
	"Neil Horman" <nhorman@tuxdriver•com>,
	linux-sctp@vger•kernel.org, netdev <netdev@vger•kernel.org>,
	"Kostya Serebryany" <kcc@google•com>,
	"Alexander Potapenko" <glider@google•com>,
	"Sasha Levin" <sasha.levin@oracle•com>,
	"Eric Dumazet" <edumazet@google•com>,
	"Maciej Żenczykowski" <maze@google•com>,
	"Dmitry Vyukov" <dvyukov@google•com>
Subject: Re: use-after-free in sctp_do_sm
Date: Thu, 3 Dec 2015 13:35:37 -0500	[thread overview]
Message-ID: <56608B79.7040105@gmail.com> (raw)
In-Reply-To: <74ED362E-9B4D-48CB-85BE-04DEDF1BFC97@gmail.com>

On 12/03/2015 01:06 PM, Marcelo wrote:
> 
> 
> Em 3 de dezembro de 2015 15:59:10 BRST, Eric Dumazet <eric.dumazet@gmail•com> escreveu:
>> On Thu, 2015-12-03 at 15:43 -0200, Marcelo Ricardo Leitner wrote:
>>
>>> Vlad, others,
>>>
>>> It's been a long time but this was introduced by commit 914e1c8b6980
>>> ("sctp: Inherit all socket options from parent correctly."). This is
>> not
>>> very consistent with how other protocols work and it will be hard to
>>> keep tracking a negative mask of flags that we can't copy.
>>>
>>> I reviewed the list of options and I'm thinking that only
>>> SO_BINDTODEVICE is worth copying, leaving the others for the
>> application
>>> to re-set, as it is for other protocols. So I'm thinking on simply:
>>>
>>> -       newsk->sk_flags = sk->sk_flags;
>>> +       newsk->sk_flags = sk->sk_flags & SO_BINDTODEVICE;
>>>
>>> in the above.
>>>
>>> What do you think?
>>
>> I think SO_BINDTODEVICE is not a flag ;)
>>
>> #define SO_BINDTODEVICE    25
> 
> Oops, indeed!
> Idea persists.
> Thx!
> 

Hmm...  sk_clone_lock() appears to copy the flags as well, so it would
appear the tcp accept() sockets would also have timestamping set.

I can see how we probably shouldn't being copying sk_flags as there isn't
much there that need to be set.

-vlad

  reply	other threads:[~2015-12-03 18:35 UTC|newest]

Thread overview: 77+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-11-24  9:15 use-after-free in sctp_do_sm Dmitry Vyukov
2015-11-24  9:31 ` Dmitry Vyukov
2015-11-24 10:10   ` Dmitry Vyukov
2015-11-24 20:45     ` Neil Horman
2015-11-24 21:08       ` Eric Dumazet
2015-11-24 21:12       ` David Miller
2015-11-25 15:12       ` Vlad Yasevich
2015-11-28 15:50         ` Dmitry Vyukov
2015-12-03 16:51           ` Marcelo Ricardo Leitner
2015-12-03 17:43             ` Marcelo Ricardo Leitner
2015-12-03 17:59               ` Eric Dumazet
2015-12-03 18:06                 ` Marcelo
2015-12-03 18:35                   ` Vlad Yasevich [this message]
2015-12-03 18:43                     ` Marcelo
2015-12-04 17:14                       ` [PATCH net 0/3] sctp: packet timestamp fixes Marcelo Ricardo Leitner
2015-12-04 17:14                         ` [PATCH net 1/3] sctp: use the same clock as if sock source timestamps were on Marcelo Ricardo Leitner
2015-12-04 20:31                           ` Vlad Yasevich
2015-12-04 17:14                         ` [PATCH net 2/3] sctp: update the netstamp_needed counter when copying sockets Marcelo Ricardo Leitner
2015-12-04 20:33                           ` Vlad Yasevich
2015-12-04 17:14                         ` [PATCH net 3/3] sctp: also copy sk_tsflags when copying the socket Marcelo Ricardo Leitner
2015-12-04 20:33                           ` Vlad Yasevich
2015-12-06  3:24                         ` [PATCH net 0/3] sctp: packet timestamp fixes David Miller
2015-12-03 13:05 ` use-after-free in sctp_do_sm Marcelo Ricardo Leitner
2015-12-03 13:45   ` Dmitry Vyukov
2015-12-03 14:48     ` Eric Dumazet
2015-12-03 15:55       ` Dmitry Vyukov
2015-12-03 16:15         ` Marcelo Ricardo Leitner
2015-12-03 17:02         ` Eric Dumazet
2015-12-03 17:12           ` Dmitry Vyukov
2015-12-03 18:52             ` Aaron Conole
2015-12-03 19:06               ` Joe Perches
2015-12-03 19:32               ` Jason Baron
2015-12-03 20:03                 ` Joe Perches
2015-12-03 20:10                   ` Jason Baron
2015-12-03 20:24                     ` Joe Perches
2015-12-03 20:42                       ` Jason Baron
2015-12-03 20:51                         ` Joe Perches
2015-12-04 10:40                           ` Dmitry Vyukov
2015-12-04 12:55                             ` Marcelo Ricardo Leitner
2015-12-04 15:37                               ` Vlad Yasevich
2015-12-04 15:51                                 ` Aaron Conole
2015-12-04 16:12                           ` Dmitry Vyukov
2015-12-04 16:47                             ` Jason Baron
2015-12-04 17:03                               ` Joe Perches
2015-12-04 17:11                                 ` Jason Baron
2015-12-04 10:41           ` Dmitry Vyukov
2015-12-04 17:48     ` Marcelo Ricardo Leitner
2015-12-04 20:25       ` Dmitry Vyukov
2015-12-04 21:34         ` Marcelo Ricardo Leitner
2015-12-04 21:38           ` Dmitry Vyukov
2015-12-05 16:39           ` Vlad Yasevich
2015-12-07 11:26             ` Dmitry Vyukov
2015-12-07 13:15               ` Marcelo Ricardo Leitner
2015-12-07 13:20                 ` Dmitry Vyukov
2015-12-07 18:52                   ` Marcelo Ricardo Leitner
2015-12-07 19:33                     ` Vlad Yasevich
2015-12-07 19:50                       ` Marcelo Ricardo Leitner
2015-12-07 20:37                         ` Vlad Yasevich
2015-12-07 20:52                           ` Marcelo Ricardo Leitner
2015-12-08 17:30                             ` Dmitry Vyukov
2015-12-08 17:40                               ` Marcelo Ricardo Leitner
2015-12-08 19:22                                 ` Dmitry Vyukov
2015-12-09 14:41                                   ` Dmitry Vyukov
2015-12-09 15:03                                     ` Marcelo Ricardo Leitner
2015-12-09 16:41                                       ` Marcelo Ricardo Leitner
2015-12-11 13:35                                         ` Dmitry Vyukov
2015-12-11 13:51                                           ` Marcelo Ricardo Leitner
2015-12-11 14:03                                             ` Marcelo Ricardo Leitner
2015-12-11 14:30                                               ` Dmitry Vyukov
2015-12-11 15:55                                                 ` Marcelo Ricardo Leitner
2016-01-08 13:00                                                   ` [PATCH] sctp: fix use-after-free in pr_debug statement Marcelo Ricardo Leitner
2016-01-11 17:00                                                     ` Vlad Yasevich
2016-01-11 22:13                                                     ` David Miller
2016-01-12  8:41                                                       ` Dmitry Vyukov
2015-12-11 18:37                                               ` use-after-free in sctp_do_sm Vlad Yasevich
2015-12-14  9:50                                                 ` David Laight
2015-12-14 14:25                                                   ` Vlad Yasevich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=56608B79.7040105@gmail.com \
    --to=vyasevich@gmail$(echo .)com \
    --cc=dvyukov@google$(echo .)com \
    --cc=edumazet@google$(echo .)com \
    --cc=eric.dumazet@gmail$(echo .)com \
    --cc=glider@google$(echo .)com \
    --cc=kcc@google$(echo .)com \
    --cc=linux-sctp@vger$(echo .)kernel.org \
    --cc=marcelo.leitner@gmail$(echo .)com \
    --cc=maze@google$(echo .)com \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=nhorman@tuxdriver$(echo .)com \
    --cc=sasha.levin@oracle$(echo .)com \
    --cc=syzkaller@googlegroups$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox