linux-kernel - [PATCH 06/16] drbd: Wrong use of RCU in receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  5 Oct 2011 11:37:54 +0200
From:	Philipp Reisner <philipp.reisner@...bit.com>
To:	linux-kernel@...r.kernel.org, Jens Axboe <axboe@...nel.dk>
Cc:	drbd-dev@...ts.linbit.com
Subject: [PATCH 06/16] drbd: Wrong use of RCU in receive_protocol()

From: Andreas Gruenbacher <agruen@...bit.com>

It is not enough to grab net_conf->integrity_alg under rcu_read_lock()
and access it outside of it; the entire net_conf object may be gone by
then.

Signed-off-by: Philipp Reisner <philipp.reisner@...bit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@...bit.com>
---
 drivers/block/drbd/drbd_receiver.c |   32 +++++++++++++++++++-------------
 1 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 6da7aeb..98f03b1 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -2998,7 +2998,6 @@ static int receive_protocol(struct drbd_tconn *tconn, struct packet_info *pi)
 	int p_proto, p_after_sb_0p, p_after_sb_1p, p_after_sb_2p;
 	int p_want_lose, p_two_primaries, cf;
 	char p_integrity_alg[SHARED_SECRET_MAX] = "";
-	unsigned char *my_alg;
 	struct net_conf *nc;
 
 	p_proto		= be32_to_cpu(p->protocol);
@@ -3009,6 +3008,18 @@ static int receive_protocol(struct drbd_tconn *tconn, struct packet_info *pi)
 	cf		= be32_to_cpu(p->conn_flags);
 	p_want_lose = cf & CF_WANT_LOSE;
 
+	if (tconn->agreed_pro_version >= 87) {
+		int err;
+
+		if (pi->size > sizeof(p_integrity_alg))
+			return -EIO;
+		err = drbd_recv_all(tconn, p_integrity_alg, pi->size);
+		if (err)
+			return err;
+
+		p_integrity_alg[SHARED_SECRET_MAX-1] = 0;
+	}
+
 	clear_bit(CONN_DRY_RUN, &tconn->flags);
 
 	if (cf & CF_DRY_RUN)
@@ -3047,23 +3058,18 @@ static int receive_protocol(struct drbd_tconn *tconn, struct packet_info *pi)
 		goto disconnect_rcu_unlock;
 	}
 
-	my_alg = nc->integrity_alg;
-	rcu_read_unlock();
-
 	if (tconn->agreed_pro_version >= 87) {
-		int err;
-
-		err = drbd_recv_all(tconn, p_integrity_alg, pi->size);
-		if (err)
-			return err;
-
-		p_integrity_alg[SHARED_SECRET_MAX-1] = 0;
-		if (strcmp(p_integrity_alg, my_alg)) {
+		if (strcmp(p_integrity_alg, nc->integrity_alg)) {
 			conn_err(tconn, "incompatible setting of the data-integrity-alg\n");
 			goto disconnect;
 		}
+	}
+
+	rcu_read_unlock();
+
+	if (tconn->agreed_pro_version >= 87) {
 		conn_info(tconn, "data-integrity-alg: %s\n",
-		     my_alg[0] ? my_alg : (unsigned char *)"<not-used>");
+			  nc->integrity_alg[0] ? nc->integrity_alg : (unsigned char *)"<not-used>");
 	}
 
 	return 0;
-- 
1.7.4.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/