netdev - Re: conntrack, suspicious RCU usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120112023540.GC12255@1984>
Date:	Thu, 12 Jan 2012 03:35:40 +0100
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Hans Schillstrom <hans.schillstrom@...csson.com>,
	"netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
	netdev <netdev@...r.kernel.org>
Subject: Re: conntrack, suspicious RCU usage

On Wed, Jan 11, 2012 at 03:56:52PM +0100, Eric Dumazet wrote:
> Le mercredi 11 janvier 2012 à 14:33 +0100, Eric Dumazet a écrit :
> > Le mercredi 11 janvier 2012 à 14:24 +0100, Hans Schillstrom a écrit :
> > > On Wednesday 11 January 2012 11:01:51 Eric Dumazet wrote:
> > 
> > > > Hmm, we either need to take rcu_read_lock() while calling
> > > > __nf_ct_l3proto_find(), or define a variant using
> > > > rcu_dereference_protected() in places we hold nf_conntrack_lock
> > > > 
> > > I made a qick test with locks /unlocks in
> > > __nf_ct_l3proto_find() and __nf_ct_l4proto_find()
> > > 
> > > 	rcu_read_lock();
> > > ...
> > > 	rcu_read_unlock();
> > > 	return retp;
> > > 
> > > It seems to help, I cant see the dump anymore and everything else that I run works ...
> > > 
> > > 
> > 
> > You cant do that, its just a brown paper bag :)
> > 
> > If "retp" is returned, then the caller must handle the rcu_read_unlock()
> > itself, after all possible "retp" dereferences.
> > 
> > But really adding rcu_read_lock() should not be necessary on paths we
> > own the conntrack lock. We should use rcu_dereference_protected()
> > instead.
> > 
> 
> Well, __nf_ct_l4proto_find() being out of line and the way we already
> use rcu_read_lock() in this code, it seems following patch is
> the most natural way to cope with these lockdep warnings.
> 
> Thanks
> 
> [PATCH] netfilter: ctnetlink: fix lockep splats

Thanks Eric. I'll pass this to davem.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html