linux-kernel - Re: [PATCH net 2/2] netconsole: Fix race condition in between reader and writer of userdata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aPdaxSUBMYwfQXW6@horms.kernel.org>
Date: Tue, 21 Oct 2025 11:04:53 +0100
From: Simon Horman <horms@...nel.org>
To: Gustavo Luiz Duarte <gustavold@...il.com>
Cc: Breno Leitao <leitao@...ian.org>, Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Shuah Khan <shuah@...nel.org>,
	Matthew Wood <thepacketgeek@...il.com>,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	linux-kselftest@...r.kernel.org
Subject: Re: [PATCH net 2/2] netconsole: Fix race condition in between reader
 and writer of userdata

On Mon, Oct 20, 2025 at 02:22:35PM -0700, Gustavo Luiz Duarte wrote:
> The update_userdata() function constructs the complete userdata string
> in nt->extradata_complete and updates nt->userdata_length. This data
> is then read by write_msg() and write_ext_msg() when sending netconsole
> messages. However, update_userdata() was not holding target_list_lock
> during this process, allowing concurrent message transmission to read
> partially updated userdata.
> 
> This race condition could result in netconsole messages containing
> incomplete or inconsistent userdata - for example, reading the old
> userdata_length with new extradata_complete content, or vice versa,
> leading to truncated or corrupted output.
> 
> Fix this by acquiring target_list_lock with spin_lock_irqsave() before
> updating extradata_complete and userdata_length, and releasing it after
> both fields are fully updated. This ensures that readers see a
> consistent view of the userdata, preventing corruption during concurrent
> access.
> 
> The fix aligns with the existing locking pattern used throughout the
> netconsole code, where target_list_lock protects access to target
> fields including buf[] and msgcounter that are accessed during message
> transmission.
> 
> Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target")

nit: no blank line here please

> 
> Signed-off-by: Gustavo Luiz Duarte <gustavold@...il.com>
> ---
>  drivers/net/netconsole.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
> index 194570443493b..1f9cf6b12dfc5 100644
> --- a/drivers/net/netconsole.c
> +++ b/drivers/net/netconsole.c
> @@ -888,6 +888,9 @@ static void update_userdata(struct netconsole_target *nt)
>  {
>  	int complete_idx = 0, child_count = 0;
>  	struct list_head *entry;
> +	unsigned long flags;
> +
> +	spin_lock_irqsave(&target_list_lock, flags);
>  
>  	/* Clear the current string in case the last userdatum was deleted */
>  	nt->userdata_length = 0;
> @@ -918,6 +921,8 @@ static void update_userdata(struct netconsole_target *nt)
>  	}
>  	nt->userdata_length = strnlen(nt->extradata_complete,
>  				      sizeof(nt->extradata_complete));
> +
> +	spin_unlock_irqrestore(&target_list_lock, flags);
>  }
>  
>  static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
> 
> -- 
> 2.47.3
> 
>