linux-kernel - Re: [PATCH net 1/2] net: Modify unix_stream_connect to not reference count the netns of kernel sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210928125047.40359-1-kuniyu@amazon.co.jp>
Date:   Tue, 28 Sep 2021 21:50:47 +0900
From:   Kuniyuki Iwashima <kuniyu@...zon.co.jp>
To:     <wanghai38@...wei.com>
CC:     <Rao.Shoaib@...cle.com>, <anna.schumaker@...app.com>,
        <ast@...nel.org>, <bfields@...ldses.org>,
        <christian.brauner@...ntu.com>, <chuck.lever@...cle.com>,
        <cong.wang@...edance.com>, <davem@...emloft.net>,
        <dsahern@...il.com>, <edumazet@...gle.com>,
        <jakub.kicinski@...ronome.com>, <jiang.wang@...edance.com>,
        <jlayton@...nel.org>, <kolga@...app.com>, <kuba@...nel.org>,
        <kuniyu@...zon.co.jp>, <linux-kernel@...r.kernel.org>,
        <linux-nfs@...r.kernel.org>, <neilb@...e.com>,
        <netdev@...r.kernel.org>, <nicolas.dichtel@...nd.com>,
        <timo@...henpieler.org>, <tom@...pey.com>,
        <trond.myklebust@...merspace.com>, <tyhicks@...onical.com>,
        <viro@...iv.linux.org.uk>, <wenbin.zeng@...il.com>,
        <willy@...radead.org>
Subject: Re: [PATCH net 1/2] net: Modify unix_stream_connect to not reference count the netns of kernel sockets

From:   Wang Hai <wanghai38@...wei.com>
Date:   Tue, 28 Sep 2021 11:14:39 +0800
> When use-gss-proxy is set to 1, write_gssp() creates a rpc client in
> gssp_rpc_create(), this increases netns refcount by 2, these refcounts
> are supposed to be released in rpcsec_gss_exit_net(), but it will never
> happen because rpcsec_gss_exit_net() is triggered only when netns
> refcount gets to 0, specifically:
>     refcount=0 -> cleanup_net() -> ops_exit_list -> rpcsec_gss_exit_net
> It is a deadlock situation here, refcount will never get to 0 unless
> rpcsec_gss_exit_net() is called. So, in this case, the netns refcount
> should not be increased.
> 
> In this case, kernel_connect()->unix_stream_connect() will take a netns
> refcount. According to commit 26abe14379f8 ("net: Modify sk_alloc to not
> reference count the netns of kernel sockets."), kernel sockets should not
> take the netns refcount, so unix_stream_connect() should not take
> the netns refcount when the sock is a kernel socket either.
> 
> Signed-off-by: Wang Hai <wanghai38@...wei.com>
> ---
>  net/unix/af_unix.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index 92345c9bb60c..af6ba67779c8 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -1317,7 +1317,8 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
>  	err = -ENOMEM;
>  
>  	/* create new sock for complete connection */
> -	newsk = unix_create1(sock_net(sk), NULL, 0, sock->type);
> +	newsk = unix_create1(sock_net(sk), NULL,
> +			     !sk->sk_net_refcnt, sock->type);

This patch conflicts with the commit f4bd73b5a950 for now.
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4bd73b5a950

Could you please rebase and resend the patch set?


>  	if (newsk == NULL)
>  		goto out;
>  
> -- 
> 2.17.1