lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20170914024441.93056-1-nixiaoming@huawei.com> Date: Thu, 14 Sep 2017 10:44:41 +0800 From: nixiaoming <nixiaoming@...wei.com> To: <davem@...emloft.net>, <edumazet@...gle.com>, <waltje@...lt.NL.Mugnet.ORG>, <gw4pts@...pts.ampr.org>, <andreyknvl@...gle.com>, <tklauser@...tanz.ch>, <philip.pettersson@...il.com>, <glider@...gle.com> CC: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <nixiaoming@...wei.com>, <dede.wu@...wei.com> Subject: [PATCH] net/packet: fix race condition between fanout_add and __unregister_prot_hook If fanout_add is preempted after running po-> fanout = match and before running __fanout_link, it will cause BUG_ON when __unregister_prot_hook call __fanout_unlink so, we need add mutex_lock(&fanout_mutex) to __unregister_prot_hook or add spin_lock(&po->bind_lock) before po-> fanout = match test on linux 4.1.12: ./trinity -c setsockopt -C 2 -X & BUG: failure at net/packet/af_packet.c:1414/__fanout_unlink()! Kernel panic - not syncing: BUG! CPU: 2 PID: 2271 Comm: trinity-c0 Tainted: G W O 4.1.12 #1 Hardware name: Hisilicon PhosphorHi1382 FPGA (DT) Call trace: [<ffffffc000209414>] dump_backtrace+0x0/0xf8 [<ffffffc00020952c>] show_stack+0x20/0x28 [<ffffffc000635574>] dump_stack+0xac/0xe4 [<ffffffc000633fb8>] panic+0xf8/0x268 [<ffffffc0005fa778>] __unregister_prot_hook+0xa0/0x144 [<ffffffc0005fba48>] packet_set_ring+0x280/0x5b4 [<ffffffc0005fc33c>] packet_setsockopt+0x320/0x950 [<ffffffc000554a04>] SyS_setsockopt+0xa4/0xd4 Signed-off-by: nixiaoming <nixiaoming@...wei.com> Tested-by: wudesheng <dede.wu@...wei.com> --- net/packet/af_packet.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 008a45c..0300146 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -365,10 +365,12 @@ static void __unregister_prot_hook(struct sock *sk, bool sync) po->running = 0; + mutex_lock(&fanout_mutex); if (po->fanout) __fanout_unlink(sk, po); else __dev_remove_pack(&po->prot_hook); + mutex_unlock(&fanout_mutex); __sock_put(sk); -- 2.11.0.1
Powered by blists - more mailing lists