Re: [PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread Eric Dumazet
On Sat, 2014-09-13 at 11:35 -0700, shakil A Khan wrote: > On Saturday, September 13, 2014 04:50:22 AM Eric Dumazet wrote: > > On Sat, 2014-09-13 at 01:27 -0700, Shakil A Khan wrote: > > > Signed-off-by: Shakil A Khan > > > --- > > > > > > net/core/dst.c | 5 - > > > 1 file changed, 4 inserti

Re: [PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread David Miller
From: Shakil k Date: Sat, 13 Sep 2014 10:46:39 -0700 > On Sat, Sep 13, 2014 at 4:50 AM, Eric Dumazet > wrote: > >> Can you describe how this could trigger with a pristine kernel ? >> This can be reproduced with our custom network traffic to simulate malware. >> > Point is the user can modify ce

Re: [PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread shakil A Khan
On Saturday, September 13, 2014 04:50:22 AM Eric Dumazet wrote: > On Sat, 2014-09-13 at 01:27 -0700, Shakil A Khan wrote: > > Signed-off-by: Shakil A Khan > > --- > > > > net/core/dst.c | 5 - > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > diff --git a/net/core/dst.c b/net/core/

Re: [PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread Eric Dumazet
On Sat, 2014-09-13 at 01:27 -0700, Shakil A Khan wrote: > Signed-off-by: Shakil A Khan > --- > net/core/dst.c | 5 - > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/core/dst.c b/net/core/dst.c > index a028409..6a848b0 100644 > --- a/net/core/dst.c > +++ b/net/core/dst.c

Re: [PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread Hannes Frederic Sowa
On Sa, 2014-09-13 at 01:27 -0700, Shakil A Khan wrote: > Signed-off-by: Shakil A Khan > --- > net/core/dst.c | 5 - > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/core/dst.c b/net/core/dst.c > index a028409..6a848b0 100644 > --- a/net/core/dst.c > +++ b/net/core/dst.c

[PATCH] Freeing dst when the reference count <0 causes general protection fault, it could be a major security flaw as rogue app can modify dst to crash kernel.

2014-09-13 Thread Shakil A Khan
Signed-off-by: Shakil A Khan --- net/core/dst.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/dst.c b/net/core/dst.c index a028409..6a848b0 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -284,7 +284,10 @@ void dst_release(struct dst_entry *dst)