netdev - Re: [PATCH -next v2] unix stream: Fix use-after-free crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1315337580.2576.3066.camel@schen9-DESK>
Date:	Tue, 06 Sep 2011 12:33:00 -0700
From:	Tim Chen <tim.c.chen@...ux.intel.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	"Yan, Zheng" <zheng.z.yan@...el.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"sfr@...b.auug.org.au" <sfr@...b.auug.org.au>,
	"jirislaby@...il.com" <jirislaby@...il.com>,
	"sedat.dilek@...il.com" <sedat.dilek@...il.com>, alex.shi@...el.com
Subject: Re: [PATCH -next v2] unix stream: Fix use-after-free crashes

On Tue, 2011-09-06 at 21:01 +0200, Eric Dumazet wrote:

> > All the skbs put on the list does have proper reference on pid/scm.  In
> > the example you give, the first skb got the reference at this line:
> > 
> > err = unix_scm_to_skb(siocb->scm, skb, !fds_sent, fds_sent);
> 
> This is the current code. We know its buggy.
> 
> I was discussing of things after proposed patch, not current net-next.

I think we are on the same page.


> My approach would basically revert the 7361c36c commit too :(

I think so.  I was not fond of commit 7361c36c as it caused a 90%
regression in threaded case of hackbench that we noticed back in 2.6.36
days.  If there's some way to undo its evil, I'm all for it.

> 
> I am sorry, but the only way to avoid too many pid/cred references is to
> lock the socket [aka unix_state_lock(other);] for the whole send()
> duration.

Yes, I think locking the sendmsg for the entire duration of
unix_stream_sendmsg makes a lot of sense.  It simplifies the logic a lot
more.  I'll try to cook something up in the next couple of days.

> 
> This way, you can really increment the pid/cred reference on the last
> pushed skb, because no reader can 'catch first skb'
> 
> As soon as unix_state_unlock(other) is called, everything can happen, so
> skb must be self contained, as I stated in my earlier mail.
> 
> 
> 

Thanks.

Tim

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html