linux-kernel - Re: qib_lookup_qpn() appears to leak pointer out of rcu_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140212215017.GF4250@linux.vnet.ibm.com>
Date:	Wed, 12 Feb 2014 13:50:18 -0800
From:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To:	"Marciniszyn, Mike" <mike.marciniszyn@...el.com>
Cc:	"roland@...nel.org" <roland@...nel.org>,
	"Hefty, Sean" <sean.hefty@...el.com>,
	"hal.rosenstock@...il.com" <hal.rosenstock@...il.com>,
	"linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock()

On Wed, Feb 12, 2014 at 02:57:14PM +0000, Marciniszyn, Mike wrote:
> BTW, I am considering eliminating the atomic_inc() in favor of widening the scope of the rcu lock expanse.

As long as the newly included code doesn't block, that should work fine.
(If it does block, another option is SRCU.)

							Thanx, Paul

> Mike
> 
> > -----Original Message-----
> > From: Paul E. McKenney [mailto:paulmck@...ux.vnet.ibm.com]
> > Sent: Wednesday, February 12, 2014 9:56 AM
> > To: Marciniszyn, Mike
> > Cc: roland@...nel.org; Hefty, Sean; hal.rosenstock@...il.com; linux-
> > rdma@...r.kernel.org; linux-kernel@...r.kernel.org
> > Subject: Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock()
> > 
> > On Wed, Feb 12, 2014 at 01:59:30PM +0000, Marciniszyn, Mike wrote:
> > > > So what am I missing here?
> > > >
> > >
> > > The atomic increment of a reference count:
> > 
> > Got it, thank you, apologies for the noise!
> > 
> > 							Thanx, Paul
> > 
> > > struct qib_qp *qib_lookup_qpn(struct qib_ibport *ibp, u32 qpn) {
> > >         struct qib_qp *qp = NULL;
> > >
> > >         rcu_read_lock();
> > >         if (unlikely(qpn <= 1)) {
> > >                 if (qpn == 0)
> > >                         qp = rcu_dereference(ibp->qp0);
> > >                 else
> > >                         qp = rcu_dereference(ibp->qp1);
> > >                 if (qp)
> > >                         atomic_inc(&qp->refcount); <--------------------------
> > >         } else {
> > >                 struct qib_ibdev *dev = &ppd_from_ibp(ibp)->dd->verbs_dev;
> > >                 unsigned n = qpn_hash(dev, qpn);
> > >
> > >                 for (qp = rcu_dereference(dev->qp_table[n]); qp;
> > >                         qp = rcu_dereference(qp->next))
> > >                         if (qp->ibqp.qp_num == qpn) {
> > >                                 atomic_inc(&qp->refcount); <---------------------
> > >                                 break;
> > >                         }
> > >         }
> > >         rcu_read_unlock();
> > >         return qp;
> > > }
> > >
> > > Mike
> > >
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/