linux-kernel - Re: [PATCH 4.19 72/95] mac80211: mesh: fix discovery timer re-arming issue / crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200601210905.GC17898@amd>
Date:   Mon, 1 Jun 2020 23:09:05 +0200
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Simon Wunderlich <sw@...onwunderlich.de>,
        Linus Lüssing <ll@...onwunderlich.de>,
        Johannes Berg <johannes.berg@...el.com>
Subject: Re: [PATCH 4.19 72/95] mac80211: mesh: fix discovery timer re-arming
 issue / crash

Hi!

> From: Linus Lüssing <ll@...onwunderlich.de>
> 
> commit e2d4a80f93fcfaf72e2e20daf6a28e39c3b90677 upstream.

> This patch fixes this issue by re-checking if mpath is about to be
> free'd and if so bails out of re-arming the timer.

> --- a/net/mac80211/mesh_hwmp.c
> +++ b/net/mac80211/mesh_hwmp.c
> @@ -1088,7 +1088,14 @@ void mesh_path_start_discovery(struct ie
>  	mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr, ifmsh->sn,
>  			       target_flags, mpath->dst, mpath->sn, da, 0,
>  			       ttl, lifetime, 0, ifmsh->preq_id++, sdata);
> +
> +	spin_lock_bh(&mpath->state_lock);
> +	if (mpath->flags & MESH_PATH_DELETED) {
> +		spin_unlock_bh(&mpath->state_lock);
> +		goto enddiscovery;
> +	}
>  	mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
> +	spin_unlock_bh(&mpath->state_lock);
>  
>  enddiscovery:
>  	rcu_read_unlock();

This made brain freeze for a while. AFAICT it can be rewritten as:

 +     spin_lock_bh(&mpath->state_lock);
 +     if (!(mpath->flags & MESH_PATH_DELETED))
  	       mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
 +     spin_unlock_bh(&mpath->state_lock);

...?

Best regards,
								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)