From patchwork Tue Jan 5 11:51:25 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Cox X-Patchwork-Id: 563053 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 870C314031C for ; Tue, 5 Jan 2016 22:51:40 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751982AbcAELvh (ORCPT ); Tue, 5 Jan 2016 06:51:37 -0500 Received: from lxorguk.ukuu.org.uk ([81.2.110.251]:47673 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751188AbcAELvf (ORCPT ); Tue, 5 Jan 2016 06:51:35 -0500 Received: from localhost.localdomain (proxy [81.2.110.250]) by lxorguk.ukuu.org.uk (8.15.2/8.14.1) with ESMTP id u05COCc9007171; Tue, 5 Jan 2016 12:24:17 GMT Subject: [PATCH] 6pack: fix free memory scribbles From: Alan To: netdev@vger.kernel.org, davem@davemloft.net Date: Tue, 05 Jan 2016 11:51:25 +0000 Message-ID: <20160105115042.8134.4926.stgit@localhost.localdomain> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free memory scribble but in doing so replaced it with a different one that allows the user to control the data and scribble even more. sixpack_close is called by the tty layer in tty context. The tty context is protected by sp_get() and sp_put(). However network layer activity via sp_xmit() is not protected this way. We must therefore stop the queue otherwise the user gets to dump a buffer mostly of their choice into freed kernel pages. Signed-off-by: Alan Cox --- drivers/net/hamradio/6pack.c | 6 ++++++ 1 file changed, 6 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 9f0b1c3..b3ba6a8 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -683,6 +683,12 @@ static void sixpack_close(struct tty_struct *tty) if (!atomic_dec_and_test(&sp->refcnt)) down(&sp->dead_sem); + /* We must stop the queue to avoid potentially scribbling + on the free buffers. The sp->dead_sem is not sufficient + to protect us from sp->xbuff access */ + + netif_stop_queue(sp->dev); + del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t);