netdev - Re: virt-manager broken by bind(0) in net-next.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090131215850.3dfc29fb@extreme>
Date:	Sat, 31 Jan 2009 21:58:50 -0800
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Evgeniy Polyakov <zbr@...emap.net>
Cc:	Eric Dumazet <dada1@...mosbay.com>,
	Herbert Xu <herbert@...dor.apana.org.au>, berrange@...hat.com,
	et-mgmt-tools@...hat.com, davem@...emloft.net,
	netdev@...r.kernel.org
Subject: Re: virt-manager broken by bind(0) in net-next.

On Sat, 31 Jan 2009 00:50:08 +0300
Evgeniy Polyakov <zbr@...emap.net> wrote:

> On Fri, Jan 30, 2009 at 07:41:59PM +0100, Eric Dumazet (dada1@...mosbay.com) wrote:
> > Reviewing commit a9d8f9110d7e953c2f2b521087a4179677843c2a
> > 
> > I see use of a hashinfo->bsockets field that :
> > 
> > - lacks proper lock/synchronization
> 
> It should contain rough number of sockets, there is no need to be very
> precise because of this hueristic.
> 
> > - suffers from cache line ping pongs on SMP
> 
> I used free alignment slot so that socket structure would not be
> icreased.
> 
> > Also there might be a problem at line 175
> > 
> > if (sk->sk_reuse && sk->sk_state != TCP_LISTEN && --attempts >= 0) { 
> > 	spin_unlock(&head->lock);
> > 	goto again;
> > 
> > If we entered inet_csk_get_port() with a non null snum, we can "goto again"
> > while it was not expected.
> > 
> > diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> > index df8e72f..752c6b2 100644
> > --- a/net/ipv4/inet_connection_sock.c
> > +++ b/net/ipv4/inet_connection_sock.c
> > @@ -172,7 +172,8 @@ tb_found:
> >  		} else {
> >  			ret = 1;
> >  			if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
> > -				if (sk->sk_reuse && sk->sk_state != TCP_LISTEN && --attempts >= 0) {
> > +				if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
> > +					smallest_size == -1 &&  --attempts >= 0) {
> 
> I think it should be smallest_size != -1, since we really want to goto
> to the again label when hueristic is used, which in turn changes
> smallest_size.
> 

Yes, this fixes the problem, not sure who wants the honors for sending a signed off
version.




--- a/net/ipv4/inet_connection_sock.c	2009-01-31 21:18:45.433239861 -0800
+++ b/net/ipv4/inet_connection_sock.c	2009-01-31 21:30:14.720825414 -0800
@@ -172,7 +172,8 @@ tb_found:
 		} else {
 			ret = 1;
 			if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
-				if (sk->sk_reuse && sk->sk_state != TCP_LISTEN && --attempts >= 0) {
+				if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
+				    smallest_size != -1 && --attempts >= 0) {
 					spin_unlock(&head->lock);
 					goto again;
 				}
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html