linux-kernel - [PATCH 0/6] Intro: convert lockd to kthread and fix use-after-free (try #6)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1199820798-5289-1-git-send-email-jlayton@redhat.com>
Date:	Tue,  8 Jan 2008 14:33:12 -0500
From:	Jeff Layton <jlayton@...hat.com>
To:	akpm@...ux-foundation.org, neilb@...e.de
Cc:	linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 0/6] Intro: convert lockd to kthread and fix use-after-free (try #6)

This is the sixth patchset to fix the use-after-free problem in lockd
which we originally discussed back in October. The main problem is
detailed in the last patch of the series. Along the way, Christoph
Hellwig mentioned that it would be advantageous to convert lockd to use
the kthread API. This patch set first makes that change and then patches
it to actually fix the use after free problem. It also fixes a couple of
minor bugs in the current lockd implementation.

Most of the changes from the last patchset were ones suggested by
Neil Brown and are:

+ fix a preexisting bug that would cause a NULL pointer dereference if
  the later kmallocs failed in svc_prepare_thread

+ additional comments to explain the rationale behind nlmsvc_ref
  increments and decrements

+ removed module_get/put from lockd(). It should no longer be necessary
  and isn't safe

+ sanity checks in lockd_down have been changed to BUG() calls. They
  should never happen and if they do, then something is very wrong.

I've done some basic testing and everything seems to work as expected.
I've also tested this against the reproducer that I have for the
use-after-free problem and this does fix it. I've tried to make this
cleanly bisectable, but have only really tested the final result.

Many thanks to Trond Myklebust, Chuck Lever, Neil Brown and Christoph
Hellwig for their guidance on this.

Signed-off-by: Jeff Layton <jlayton@...hat.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/