Re: KASAN: use-after-free Read in cipso_v4_genopt
flat view
From: Paul Moore <paul@paul-moore.com>
Date: 2021-03-03 11:02:28
Also in:
linux-security-module, lkml
On Tue, Mar 2, 2021 at 2:15 PM Dmitry Vyukov [off-list ref] wrote: ...
Not sure if it's the root cause or not, but I am looking at this reference drop in cipso_v4_doi_remove: https://elixir.bootlin.com/linux/v5.12-rc1/source/net/ipv4/cipso_ipv4.c#L522 The thing is that it does not remove from the list if reference is not 0, right? So what if I send 1000 of netlink remove messages? Will it drain refcount to 0? I did not read all involved code, but the typical pattern is to drop refcount and always remove from the list. Then the last use will delete the object. Does it make any sense?
Looking at it quickly, the logic above seems sane. I wrote this code a *long* time ago, so let me get my head back into it and make sure that still holds. -- paul moore www.paul-moore.com