linux-kernel - Re: [PATCH 04/10] Protect kref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Jul 2019 12:25:59 -0300
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Maksym Planeta <mplaneta@...inf.tu-dresden.de>
Cc:     Moni Shoua <monis@...lanox.com>,
        Doug Ledford <dledford@...hat.com>, linux-rdma@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 04/10] Protect kref_put with the lock

On Mon, Jul 22, 2019 at 05:14:20PM +0200, Maksym Planeta wrote:
> Need to ensure that kref_put does not run concurrently with the loop
> inside rxe_pool_get_key.
>
> Signed-off-by: Maksym Planeta <mplaneta@...inf.tu-dresden.de>
>  drivers/infiniband/sw/rxe/rxe_pool.c | 18 ++++++++++++++++++
>  drivers/infiniband/sw/rxe/rxe_pool.h |  4 +---
>  2 files changed, 19 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
> index efa9bab01e02..30a887cf9200 100644
> +++ b/drivers/infiniband/sw/rxe/rxe_pool.c
> @@ -536,3 +536,21 @@ void *rxe_pool_get_key(struct rxe_pool *pool, void *key)
>  	read_unlock_irqrestore(&pool->pool_lock, flags);
>  	return node ? elem : NULL;
>  }
> +
> +static void rxe_dummy_release(struct kref *kref)
> +{
> +}
> +
> +void rxe_drop_ref(struct rxe_pool_entry *pelem)
> +{
> +	int res;
> +	struct rxe_pool *pool = pelem->pool;
> +	unsigned long flags;
> +
> +	write_lock_irqsave(&pool->pool_lock, flags);
> +	res = kref_put(&pelem->ref_cnt, rxe_dummy_release);
> +	write_unlock_irqrestore(&pool->pool_lock, flags);

This doesn't make sense..

If something is making the kref go to 0 while the node is still in the
RB tree then that is a bug.

You should never need to add locking around a kref_put.

Jason