netdev - Re: [PATCH v2] net/mlx4_en: protect ring->xdp_prog with rcu_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 06 Sep 2016 13:42:02 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     bblanco@...mgrid.com
Cc:     netdev@...r.kernel.org, daniel@...earbox.net,
        alexei.starovoitov@...il.com, ttoukan.linux@...il.com,
        gerlitz.or@...il.com, tom@...bertland.com,
        saeedm@....mellanox.co.il
Subject: Re: [PATCH v2] net/mlx4_en: protect ring->xdp_prog with
 rcu_read_lock

From: Brenden Blanco <bblanco@...mgrid.com>
Date: Sat,  3 Sep 2016 21:29:58 -0700

> Depending on the preempt mode, the bpf_prog stored in xdp_prog may be
> freed despite the use of call_rcu inside bpf_prog_put. The situation is
> possible when running in PREEMPT_RCU=y mode, for instance, since the rcu
> callback for destroying the bpf prog can run even during the bh handling
> in the mlx4 rx path.
> 
> Several options were considered before this patch was settled on:
 ...
> v2:
> Remove extra rcu_read_lock in mlx4_en_process_rx_cq body
> Annotate xdp_prog with __rcu, and convert all usages to rcu_assign or
> rcu_dereference[_protected] as appropriate.
> Add explicit mutex lock around rcu_assign instead of xchg loop.
> 
> Fixes: d576acf0a22 ("net/mlx4_en: add page recycle to prepare rx ring for tx support")
> Acked-by: Daniel Borkmann <daniel@...earbox.net>
> Acked-by: Alexei Starovoitov <alexei.starovoitov@...il.com>
> Signed-off-by: Brenden Blanco <bblanco@...mgrid.com>

Applied.