netdev - Re: [PATCH net v3] can: raw: fix receiver memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 17 Jul 2023 09:27:29 +0200
From: Marc Kleine-Budde <mkl@...gutronix.de>
To: Ziyang Xuan <william.xuanziyang@...wei.com>
Cc: socketcan@...tkopp.net, davem@...emloft.net, edumazet@...gle.com,
	kuba@...nel.org, pabeni@...hat.com, linux-can@...r.kernel.org,
	netdev@...r.kernel.org, penguin-kernel@...ove.SAKURA.ne.jp
Subject: Re: [PATCH net v3] can: raw: fix receiver memory leak

On 11.07.2023 09:17:37, Ziyang Xuan wrote:
> Got kmemleak errors with the following ltp can_filter testcase:
> 
> for ((i=1; i<=100; i++))
> do
>         ./can_filter &
>         sleep 0.1
> done
> 
> ==============================================================
> [<00000000db4a4943>] can_rx_register+0x147/0x360 [can]
> [<00000000a289549d>] raw_setsockopt+0x5ef/0x853 [can_raw]
> [<000000006d3d9ebd>] __sys_setsockopt+0x173/0x2c0
> [<00000000407dbfec>] __x64_sys_setsockopt+0x61/0x70
> [<00000000fd468496>] do_syscall_64+0x33/0x40
> [<00000000b7e47d51>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
> 
> It's a bug in the concurrent scenario of unregister_netdevice_many()
> and raw_release() as following:
> 
>              cpu0                                        cpu1
> unregister_netdevice_many(can_dev)
>   unlist_netdevice(can_dev) // dev_get_by_index() return NULL after this
>   net_set_todo(can_dev)
> 						raw_release(can_socket)
> 						  dev = dev_get_by_index(, ro->ifindex); // dev == NULL
> 						  if (dev) { // receivers in dev_rcv_lists not free because dev is NULL
> 						    raw_disable_allfilters(, dev, );
> 						    dev_put(dev);
> 						  }
> 						  ...
> 						  ro->bound = 0;
> 						  ...
> 
> call_netdevice_notifiers(NETDEV_UNREGISTER, )
>   raw_notify(, NETDEV_UNREGISTER, )
>     if (ro->bound) // invalid because ro->bound has been set 0
>       raw_disable_allfilters(, dev, ); // receivers in dev_rcv_lists will never be freed
> 
> Add a net_device pointer member in struct raw_sock to record bound can_dev,
> and use rtnl_lock to serialize raw_socket members between raw_bind(), raw_release(),
> raw_setsockopt() and raw_notify(). Use ro->dev to decide whether to free receivers in
> dev_rcv_lists.
> 
> Fixes: 8d0caedb7596 ("can: bcm/raw/isotp: use per module netdevice notifier")
> Signed-off-by: Ziyang Xuan <william.xuanziyang@...wei.com>
> Reviewed-by: Oliver Hartkopp <socketcan@...tkopp.net>
> Acked-by: Oliver Hartkopp <socketcan@...tkopp.net>

Added to linux-can/testing.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)