netdev - Re: [PATCH 6/7] [IPSEC]: Lock state when copying non-atomic fields to user-space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200711261203.46195.nakam@linux-ipv6.org>
Date:	Mon, 26 Nov 2007 12:03:46 +0900
From:	Masahide NAKAMURA <nakam@...ux-ipv6.org>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH 6/7] [IPSEC]: Lock state when copying non-atomic fields to user-space

Hello Herbert,

Wednesday 10 October 2007 09:48, Herbert Xu wrote:
> On Tue, Oct 09, 2007 at 01:33:07PM -0700, David Miller wrote:
> >
> > I would be more careful with the changelog description for
> > something like this in the future.  It sounds like this
> > patch will cause us to touch userspace with locks held,
> > which obviously only works in very limited scenerios
> > and is usually a BUG.
> > 
> > But you're actually just constructing SKB response netlink
> > bits, which later will be copied into userspace but long
> > after we've released these locks.
> 
> Good point.  I should've said skb destined for user-spac

With SMP enabled kernel, I found a lock problem at xfrm_state_walk()
path with the patch on current net-2.6.25. Its log is "circular locking
dependency detected".

As you might notice it, to fix it possibly you should have either:

(1) Change xfrm_state_walk() as xfrm_state_flush() does; Unlock
just before accessing the state instance and increment its reference
count, then call the hook.

or
(2) Change (or create new) hook functions for xfrm_state_walk() without
any lock since it is called within the list global lock (aka xfrm_state_lock ) is held
i.e. af_key.c(dump_sa),  xfrm_user.c(copy_to_user_state_extra).

Regards,

-- 
Masahide NAKAMURA
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html