linux-kernel - Re: [PATCH] tun: Fix use-after-free in tun_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpUfpruaFowbiTOY7aH4Ts-xcY4JACGLOT3CUjLqpg_zXw@mail.gmail.com>
Date:   Sun, 28 Apr 2019 10:59:36 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Jason Wang <jasowang@...hat.com>
Cc:     "weiyongjun (A)" <weiyongjun1@...wei.com>,
        yuehaibing <yuehaibing@...wei.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "brouer@...hat.com" <brouer@...hat.com>,
        "mst@...hat.com" <mst@...hat.com>,
        "lirongqing@...du.com" <lirongqing@...du.com>,
        "nicolas.dichtel@...nd.com" <nicolas.dichtel@...nd.com>,
        "3chas3@...il.com" <3chas3@...il.com>,
        "wangli39@...du.com" <wangli39@...du.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Peter Xu <peterx@...hat.com>
Subject: Re: [PATCH] tun: Fix use-after-free in tun_net_xmit

On Sun, Apr 28, 2019 at 12:51 AM Jason Wang <jasowang@...hat.com> wrote:
> > tun_net_xmit() doesn't have the chance to
> > access the change because it holding the rcu_read_lock().
>
>
> The problem is the following codes:
>
>
>          --tun->numqueues;
>
>          ...
>
>          synchronize_net();
>
> We need make sure the decrement of tun->numqueues be visible to readers
> after synchronize_net(). And in tun_net_xmit():

It doesn't matter at all. Readers are okay to read it even they still use the
stale tun->numqueues, as long as the tfile is not freed readers can read
whatever they want...

The decrement of tun->numqueues is just how we unpublish the old
tfile, it is still valid for readers to read it _after_ unpublish, we only need
to worry about free, not about unpublish. This is the whole spirit of RCU.

You need to rethink about my SOCK_RCU_FREE patch.

Thanks.