netdev - Re: [PATCH] netpoll: fix race on poll_list resulting in garbage entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 09 Dec 2008 23:22:45 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	nhorman@...driver.com
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] netpoll: fix race on poll_list resulting in garbage
 entry

From: Neil Horman <nhorman@...driver.com>
Date: Tue, 9 Dec 2008 16:06:44 -0500

> Hey all-
> 	A few months back a race was discused between the netpoll napi service
> path, and the fast path through net_rx_action:
> http://kerneltrap.org/mailarchive/linux-netdev/2007/10/16/345470
> 
> A patch was submitted for that bug, but I think we missed a case.
> 
> Consider the following scenario:
> 
> INITIAL STATE
> CPU0 has one napi_struct A on its poll_list
> CPU1 is calling netpoll_send_skb and needs to call poll_napi on the same
> napi_struct A that CPU0 has on its list
> 
> 
> 
> CPU0						CPU1
> net_rx_action					poll_napi
> !list_empty (returns true)			locks poll_lock for A
> 						 poll_one_napi
> 						  napi->poll
> 						   netif_rx_complete
> 						    __napi_complete
> 						    (removes A from poll_list)
> list_entry(list->next)
> 
 ...
> Signed-off-by: Neil Horman <nhorman@...driver.com>

Looks good, applied.

Thanks Neil!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html