lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 15 Jun 2015 11:07:36 +0900 From: Simon Horman <simon.horman@...ronome.com> To: sfeldma@...il.com Cc: netdev@...r.kernel.org, jiri@...nulli.us, makita.toshiaki@....ntt.co.jp Subject: Re: [PATCH net-next] rocker: fix neigh tbl index increment race On Fri, Jun 12, 2015 at 09:24:40PM -0700, sfeldma@...il.com wrote: > From: Scott Feldman <sfeldma@...il.com> > > rocker->neigh_tbl_next_index is used to generate unique indices for neigh > entries programmed into the device. The way new indices were generated was > racy with the new prepare-commit transaction model. A simple fix here > removes the race. The race was with two processes getting the same index, > one process using prepare-commit, the other not: > > Proc A Proc B > > PREPARE phase > get neigh_tbl_next_index > > NONE phase > get neigh_tbl_next_index > neigh_tbl_next_index++ > > COMMIT phase > neigh_tbl_next_index++ > > Both A and B got the same index. The fix is to store and increment > neigh_tbl_next_index in the PREPARE (or NONE) phase and use value in COMMIT > phase: > > Proc A Proc B > > PREPARE phase > get neigh_tbl_next_index > neigh_tbl_next_index++ > > NONE phase > get neigh_tbl_next_index > neigh_tbl_next_index++ > > COMMIT phase > // use value stashed in PREPARE phase > > Reported-by: Simon Horman <simon.horman@...ronome.com> > Signed-off-by: Scott Feldman <sfeldma@...il.com> Reviewed-by: Simon Horman <simon.horman@...ronome.com> > --- > drivers/net/ethernet/rocker/rocker.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c > index c6a6e3c..a9d1559 100644 > --- a/drivers/net/ethernet/rocker/rocker.c > +++ b/drivers/net/ethernet/rocker/rocker.c > @@ -2901,10 +2901,10 @@ static void _rocker_neigh_add(struct rocker *rocker, > enum switchdev_trans trans, > struct rocker_neigh_tbl_entry *entry) > { > - entry->index = rocker->neigh_tbl_next_index; > + if (trans != SWITCHDEV_TRANS_COMMIT) > + entry->index = rocker->neigh_tbl_next_index++; > if (trans == SWITCHDEV_TRANS_PREPARE) > return; > - rocker->neigh_tbl_next_index++; > entry->ref_count++; > hash_add(rocker->neigh_tbl, &entry->entry, > be32_to_cpu(entry->ip_addr)); > -- > 1.7.10.4 > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists