| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 17 Oct 2017 19:40:48 +0300
From: Vasily Averin <vvs@...tuozzo.com>
To: linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: "J. Bruce Fields" <bfields@...ldses.org>,
Jeff Layton <jlayton@...chiereds.net>
Subject: [RFC PATCH 0/2] race of lockd/nfsd inetaddr notifiers with pointers
change
lockd and nfsd inet[6]addr notifiers use pointer that can be changed during execution.
lockd_inet[6]addr_event use nlmsvc_rqst without taken nlmsvc_mutex,
nfsd notifier have similar trouble.
We got few crashes from OpenVz customers on RHEL6-based kernel,
and I have reproduced the problem locally on this kernel.
I was unable to reproduce the problem on new kernels,
however seems they are affected.
We cannot add mutexes into notifiers because inet6addr notifiers should be atomic.
To fix the problem I use atomic counter and waitqueue:
counter allows notifier to access the pointer,
waitqueue allows to delay stop of service until notifier is in use.
Patches was not tested because I was unable to reproduce the problem on new kernels.
Please review it carefully and let me know if this can be fixed in a better way.
Vasily Averin (2):
race of lockd inetaddr notifiers with nlmsvc_rqst change
race of nfsd inetaddr notifiers with nn->nfsd_serv change
fs/lockd/svc.c | 16 ++++++++++++++--
fs/nfsd/netns.h | 3 +++
fs/nfsd/nfsctl.c | 3 +++
fs/nfsd/nfssvc.c | 14 +++++++++++---
4 files changed, 31 insertions(+), 5 deletions(-)
--
2.7.4
Powered by blists - more mailing lists