2020-11-09 06:57:12

by Martin Schiller

Subject: [RESEND PATCH v2] net/x25: Fix null-ptr-deref in x25_connect

This fixes a regression for blocking connects introduced by commit
4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect").

The x25->neighbour is already set to "NULL" by x25_disconnect() now,
while a blocking connect is waiting in
x25_wait_for_connection_establishment(). Therefore x25->neighbour must
not be accessed here again and x25->state is also already set to
X25_STATE_0 by x25_disconnect().

Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Martin Schiller <[email protected]>
---

Change from v1:
also handle interrupting signals correctly

---
net/x25/af_x25.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 0bbb283f23c9..046d3fee66a9 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -825,7 +825,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
sock->state = SS_CONNECTED;
rc = 0;
out_put_neigh:
- if (rc) {
+ if (rc && x25->neighbour) {
read_lock_bh(&x25_list_lock);
x25_neigh_put(x25->neighbour);
x25->neighbour = NULL;
--
2.20.1

2020-11-11 11:41:21

by Xie He

Subject: Re: [RESEND PATCH v2] net/x25: Fix null-ptr-deref in x25_connect

> This fixes a regression for blocking connects introduced by commit
> 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect").

> The x25->neighbour is already set to "NULL" by x25_disconnect() now,
> while a blocking connect is waiting in
> x25_wait_for_connection_establishment(). Therefore x25->neighbour must
> not be accessed here again and x25->state is also already set to
> X25_STATE_0 by x25_disconnect().

> Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
> Signed-off-by: Martin Schiller <[email protected]>

Oh. Sorry, I didn't see your patch. I just submitted another patch to fix
the same problem.

I also found another problem introduced by the same regression commit,
which I was also trying to fix in my patch.

See:
http://patchwork.ozlabs.org/project/netdev/patch/[email protected]/

2020-11-11 12:02:21

by Xie He

Subject: Re: [RESEND PATCH v2] net/x25: Fix null-ptr-deref in x25_connect

> @@ -825,7 +825,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
> sock->state = SS_CONNECTED;
> rc = 0;
> out_put_neigh:
> - if (rc) {
> + if (rc && x25->neighbour) {
> read_lock_bh(&x25_list_lock);
> x25_neigh_put(x25->neighbour);
> x25->neighbour = NULL;

Thanks! It's amazing to see we are trying to fix the same issue.

Reviewed-by: Xie He <[email protected]>

2020-11-12 01:37:12

by Jakub Kicinski

Subject: Re: [RESEND PATCH v2] net/x25: Fix null-ptr-deref in x25_connect

On Wed, 11 Nov 2020 03:59:47 -0800 Xie He wrote:
> > @@ -825,7 +825,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
> > sock->state = SS_CONNECTED;
> > rc = 0;
> > out_put_neigh:
> > - if (rc) {
> > + if (rc && x25->neighbour) {
> > read_lock_bh(&x25_list_lock);
> > x25_neigh_put(x25->neighbour);
> > x25->neighbour = NULL;
>
> Reviewed-by: Xie He <[email protected]>

Applied, thanks!