linux-kernel - Re: [PATCH net V2] tun: fix use after free for ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 May 2018 09:52:51 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        "Michael S. Tsirkin" <mst@...hat.com>
Subject: Re: [PATCH net V2] tun: fix use after free for ptr_ring



On 2018年05月12日 01:39, Cong Wang wrote:
> On Thu, May 10, 2018 at 7:49 PM, Jason Wang <jasowang@...hat.com> wrote:
>>   static void __tun_detach(struct tun_file *tfile, bool clean)
>>   {
>>          struct tun_file *ntfile;
>> @@ -736,7 +727,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>>                              tun->dev->reg_state == NETREG_REGISTERED)
>>                                  unregister_netdevice(tun->dev);
>>                  }
>> -               tun_cleanup_tx_ring(tfile);
>> +               if (tun)
>> +                       xdp_rxq_info_unreg(&tfile->xdp_rxq);
>>                  sock_put(&tfile->sk);
>>          }
>>   }
>> @@ -783,14 +775,14 @@ static void tun_detach_all(struct net_device *dev)
>>                  tun_napi_del(tun, tfile);
>>                  /* Drop read queue */
>>                  tun_queue_purge(tfile);
>> +               xdp_rxq_info_unreg(&tfile->xdp_rxq);
>>                  sock_put(&tfile->sk);
>> -               tun_cleanup_tx_ring(tfile);
>>          }
>>          list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
>>                  tun_enable_queue(tfile);
>>                  tun_queue_purge(tfile);
>> +               xdp_rxq_info_unreg(&tfile->xdp_rxq);
>>                  sock_put(&tfile->sk);
>> -               tun_cleanup_tx_ring(tfile);
> Are you sure t is safe?
>
> xdp_rxq_info_unreg() can't be called more than once either,
> please make sure the warning that commit c13da21cdb80
> ("tun: avoid calling xdp_rxq_info_unreg() twice") fixed will not
> show up again.

I think it's safe. xdp_rxq_info_unreg() will be called when socket were 
detached from netdevice, and there's only two possible paths: release() 
and uninit(). We've synced them through rtnl lock.

Thanks