From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754575AbbLJP6X (ORCPT ); Thu, 10 Dec 2015 10:58:23 -0500 Received: from mail-pa0-f45.google.com ([209.85.220.45]:33182 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751661AbbLJP6V (ORCPT ); Thu, 10 Dec 2015 10:58:21 -0500 Message-ID: <1449763097.9768.13.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: [PATCH net] ipv6: sctp: clone options to avoid use after free From: Eric Dumazet To: David Laight Cc: "'Daniel Borkmann'" , Marcelo Ricardo Leitner , Eric Dumazet , Dmitry Vyukov , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Vlad Yasevich , Neil Horman , "linux-sctp@vger.kernel.org" , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin Date: Thu, 10 Dec 2015 07:58:17 -0800 In-Reply-To: <063D6719AE5E284EB5DD2968C1650D6D1CBEA7A3@AcuExch.aculab.com> References: <20151209145917.GA3884@mrl.redhat.com> <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> <063D6719AE5E284EB5DD2968C1650D6D1CBE9A61@AcuExch.aculab.com> <1449676782.9768.9.camel@edumazet-glaptop2.roam.corp.google.com> <063D6719AE5E284EB5DD2968C1650D6D1CBE9B1C@AcuExch.aculab.com> <566860BC.4040604@gmail.com> <56687EBB.5040108@iogearbox.net> <063D6719AE5E284EB5DD2968C1650D6D1CBEA7A3@AcuExch.aculab.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2015-12-10 at 12:26 +0000, David Laight wrote: > Yes, I'm worried about whether our M3UA code is likely to crash customer > systems, not whether hostile applications can crash it. > These boxes ought to be on private networks since the sigtran protocols > themselves have nothing that even gives a hint of security. As long as the listener socket is kept as is, meaning that the only use of it is the poll()/select()/accept() system calls, you are safe. The bug is about having a fuzzer, specifically playing games with multi threads so that the listener ipv6 options are changed after accept(). This should not really happen in real world applications : If ipv6 options need to be set on listener, they are set before first accept() is performed, and not unset until application exits and kill all sessions. BTW, are you even using IPv6 SCTP sessions ? From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Date: Thu, 10 Dec 2015 15:58:17 +0000 Subject: Re: [PATCH net] ipv6: sctp: clone options to avoid use after free Message-Id: <1449763097.9768.13.camel@edumazet-glaptop2.roam.corp.google.com> List-Id: References: <20151209145917.GA3884@mrl.redhat.com> <1449674706.9768.5.camel@edumazet-glaptop2.roam.corp.google.com> <063D6719AE5E284EB5DD2968C1650D6D1CBE9A61@AcuExch.aculab.com> <1449676782.9768.9.camel@edumazet-glaptop2.roam.corp.google.com> <063D6719AE5E284EB5DD2968C1650D6D1CBE9B1C@AcuExch.aculab.com> <566860BC.4040604@gmail.com> <56687EBB.5040108@iogearbox.net> <063D6719AE5E284EB5DD2968C1650D6D1CBEA7A3@AcuExch.aculab.com> In-Reply-To: <063D6719AE5E284EB5DD2968C1650D6D1CBEA7A3@AcuExch.aculab.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: David Laight Cc: 'Daniel Borkmann' , Marcelo Ricardo Leitner , Eric Dumazet , Dmitry Vyukov , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Vlad Yasevich , Neil Horman , "linux-sctp@vger.kernel.org" , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin On Thu, 2015-12-10 at 12:26 +0000, David Laight wrote: > Yes, I'm worried about whether our M3UA code is likely to crash customer > systems, not whether hostile applications can crash it. > These boxes ought to be on private networks since the sigtran protocols > themselves have nothing that even gives a hint of security. As long as the listener socket is kept as is, meaning that the only use of it is the poll()/select()/accept() system calls, you are safe. The bug is about having a fuzzer, specifically playing games with multi threads so that the listener ipv6 options are changed after accept(). This should not really happen in real world applications : If ipv6 options need to be set on listener, they are set before first accept() is performed, and not unset until application exits and kill all sessions. BTW, are you even using IPv6 SCTP sessions ?