lkml.org 
[lkml]   [2020]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 1/2] dccp: ccid: move timers to struct dccp_sock
    From
    Date
    On 13/10/2020 19:18, Kleber Sacilotto de Souza wrote:
    > From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    >
    > When dccps_hc_tx_ccid is freed, ccid timers may still trigger. The reason
    > del_timer_sync can't be used is because this relies on keeping a reference
    > to struct sock. But as we keep a pointer to dccps_hc_tx_ccid and free that
    > during disconnect, the timer should really belong to struct dccp_sock.
    >
    > This addresses CVE-2020-16119.
    >
    > Fixes: 839a6094140a (net: dccp: Convert timers to use timer_setup())
    > Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    > Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

    Acked-bd: Richard Sailer <richard_siegfried@systemli.org>

    Implementation and concept looks fine to me

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2020-10-13 21:09    [W:8.564 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site