linux-kernel - Re: ipv4: crash at leaf_walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOaiJ-mNeR63cOGBxUOJTP40mzS1QMzNNAhc+BbFAoE1NQc30A@mail.gmail.com>
Date:	Wed, 31 Jul 2013 19:01:26 +0530
From:	vinayak menon <vinayakm.list@...il.com>
To:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	vinayak menon <vinayakm.list@...il.com>,
	linux-kernel@...r.kernel.org, davem@...emloft.net,
	getarunks@...il.com, netdev@...r.kernel.org
Subject: Re: ipv4: crash at leaf_walk_rcu

On Wed, Jul 31, 2013 at 6:43 PM, Hannes Frederic Sowa
<hannes@...essinduktion.org> wrote:
> On Wed, Jul 31, 2013 at 05:55:13AM -0700, Paul E. McKenney wrote:
>> On Wed, Jul 31, 2013 at 04:40:47PM +0530, vinayak menon wrote:
>> > Hi,
>> >
>> > A crash was seen on 3.4.5 kernel during some random wlan operations.
>> >
>> > CPU: Single core ARM Cortex A9.
>> >
>> > fib_route_seq_next was called with second argument (void *v) as 0xd6e3e360
>> > which is a "freed" object of the "ip_fib_trie" cache. I confirmed that the
>> > object was freed with crash utility.
>> >
>> > Sequence: fib_route_seq_next->trie_nextleaf->leaf_walk_rcu
>> >
>> > As "v" was a freed object, inside trie_nextleaf(), node_parent_rcu()
>> > returned an invalid tnode. But as I had enabled slab poisoning and the
>> > object was already freed, the tnode was 0x6b6b6b6b. And this was passed to
>> > leaf_walk_rcu and resulted in the crash.
>> >
>> > fib_route_seq_start, takes rcu_read_lock(), but free_leaf
>> > calls call_rcu_bh. Can this be the problem ?
>> > Should rcu_read_lock() in fib_route_seq_start be changed to rcu_read_lock_bh()
>> > ?
>>
>> One way or the other, the RCU read-side primitives need to match the RCU
>> update-side primitives.  Adding netdev...
>
> Already fixed by:
>
> commit 0c03eca3d995e73d691edea8c787e25929ec156d
> Author: Eric Dumazet <edumazet@...gle.com>
> Date:   Tue Aug 7 00:47:11 2012 +0000
>
>     net: fib: fix incorrect call_rcu_bh()
>
>     After IP route cache removal, I believe rcu_bh() has very little use and
>     we should remove this RCU variant, since it adds some cycles in fast
>     path.
>
>     Anyway, the call_rcu_bh() use in fib_true is obviously wrong, since
>     some users only assert rcu_read_lock().
>

Thanks. I missed this somehow.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/