lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220705123933.GD23621@ziepe.ca> Date: Tue, 5 Jul 2022 09:39:33 -0300 From: Jason Gunthorpe <jgg@...pe.ca> To: Bart Van Assche <bvanassche@....org> Cc: Hillf Danton <hdanton@...a.com>, Mike Christie <michael.christie@...cle.com>, "lizhijian@...itsu.com" <lizhijian@...itsu.com>, Leon Romanovsky <leon@...nel.org>, "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>, "target-devel@...r.kernel.org" <target-devel@...r.kernel.org>, open list <linux-kernel@...r.kernel.org> Subject: Re: use-after-free in srpt_enable_tpg() On Mon, Jul 04, 2022 at 09:34:07PM -0700, Bart Van Assche wrote: > On 7/3/22 17:11, Hillf Danton wrote: > > On Sun, 3 Jul 2022 07:55:05 -0700 Bart Van Assche wrote: > > > However, I'm not sure that would make a > > > significant difference since there is a similar while-loop in one of the > > > callers of srpt_remove_one() (disable_device() in the RDMA core). > > > > Hehe... feel free to shed light on how the loop in RDMA core is currently > > making the loop in srpt more prone to uaf? > > In my email I was referring to the following code in disable_device(): > > wait_for_completion(&device->unreg_completion); > > I think that code shows that device removal by the RDMA core is synchronous > in nature. Even if the ib_srpt source code would be modified such that the > objects referred by that code live longer, the wait loop in disable_device() > would wait for the ib_device reference counts to drop to zero. That is not really the "ib_device" reference count it is the "registration" reference count. IB has a system where drivers/ulp can create critical regions where the ib device must be registered using the ib_device_try_get()/put calls. "Must be registered" is useful in a number of places but should not be held for a long period. This is distinct from the normal struct device refcount that simply keeps the ib_device memory alive. Jason
Powered by blists - more mailing lists