linux-kernel - Re: IPv6 deadlock with CONFIG_IPV6_ROUTER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 23 Aug 2012 11:51:41 -0400
From:	"Banerjee, Debabrata" <dbanerje@...mai.com>
To:	Lin Ming <mlin@...pku.edu.cn>
CC:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"Hunt, Joshua" <johunt@...mai.com>,
	"dbavatar@...il.com" <dbavatar@...il.com>,
	"Lubashev, Igor" <ilubashe@...mai.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: IPv6 deadlock with CONFIG_IPV6_ROUTER_PREF

On Aug 23, 2012, at 11:11 AM, "Lin Ming" <mlin@...pku.edu.cn> wrote:

> On Fri, Aug 17, 2012 at 1:58 AM, Banerjee, Debabrata
> <dbanerje@...mai.com> wrote:
>> This code tries to send a neighbor discovery ICMPv6 packet for router
>> reachability while read_lock(tb6_lock) is held. The send may want to cause
>> a fib6_clean_all() garbage collection, which will try to take
>> write_lock(tb6_lock), resulting in deadlock. Garbage collection becomes
>> more likely under high load of cloned routes, so this is exploitable as a
>> DDOS attack, given enough attack hosts in relation max_size of the route
>> table (default of 4k). I checked from 3.6-rc1 back to 2.6.32, it is
>> present everywhere.
> 
> How about moving the garbage collection to a kernel thread?
> Then the write_lock(tb6_lock) in this kernel thread won't cause such
> kind of dead lock with other threads.
> 
> Lin Ming

It already runs in a thread, this is a forced gc because we are over the gc threshold, and this thread deadlocks with itself. I thing Cong Wang is on the right track with his patch. The implementation of this RFC must be fixed.

-Debabrata
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/