netdev - RE: [PATCH] net: fix a race in gro_cell

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <504C9EFCA2D0054393414C9CB605C37F1BFC4186@SJEXCHMB06.corp.ad.broadcom.com>
Date:	Mon, 10 Dec 2012 22:46:44 +0000
From:	"Dmitry Kravkov" <dmitry@...adcom.com>
To:	"Eric Dumazet" <eric.dumazet@...il.com>,
	"David Miller" <davem@...emloft.net>
cc:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH] net: fix a race in gro_cell_poll()


> -----Original Message-----
> From: Eric Dumazet [mailto:eric.dumazet@...il.com]
> Sent: Tuesday, December 11, 2012 12:32 AM
> To: Dmitry Kravkov; David Miller
> Cc: netdev@...r.kernel.org
> Subject: [PATCH] net: fix a race in gro_cell_poll()
> 
> From: Eric Dumazet <edumazet@...gle.com>
> 
> Dmitry Kravkov reported packet drops for GRE packets since GRO support
> was added.
> 
> There is a race in gro_cell_poll() because we call napi_complete()
> without any synchronization with a concurrent gro_cells_receive()
> 
> Once bug was triggered, we queued packets but did not schedule NAPI
> poll.
> 
> We can fix this issue using the spinlock protected the napi_skbs queue,
> as we have to hold it to perform skb dequeue anyway.
> 
> As we open-code skb_dequeue(), we no longer need to mask IRQS, as both
> producer and consumer run under BH context.
> 
> Bug added in commit c9e6bc644e (net: add gro_cells infrastructure)
> 
> Reported-by: Dmitry Kravkov <dmitry@...adcom.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> ---
> 
> David: I could reproduce the bug Dmitry reported, and have
>   verified this patch fixes the issue.
> 
>  include/net/gro_cells.h |   14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
> index 4fd8a4b..e5062c9 100644
> --- a/include/net/gro_cells.h
> +++ b/include/net/gro_cells.h
> @@ -17,7 +17,6 @@ struct gro_cells {
> 
>  static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
>  {
> -	unsigned long flags;
>  	struct gro_cell *cell = gcells->cells;
>  	struct net_device *dev = skb->dev;
> 
> @@ -35,32 +34,37 @@ static inline void gro_cells_receive(struct gro_cells
> *gcells, struct sk_buff *s
>  		return;
>  	}
> 
> -	spin_lock_irqsave(&cell->napi_skbs.lock, flags);
> +	/* We run in BH context */
> +	spin_lock(&cell->napi_skbs.lock);
> 
>  	__skb_queue_tail(&cell->napi_skbs, skb);
>  	if (skb_queue_len(&cell->napi_skbs) == 1)
>  		napi_schedule(&cell->napi);
> 
> -	spin_unlock_irqrestore(&cell->napi_skbs.lock, flags);
> +	spin_unlock(&cell->napi_skbs.lock);
>  }
> 
> +/* called unser BH context */
>  static inline int gro_cell_poll(struct napi_struct *napi, int budget)
>  {
>  	struct gro_cell *cell = container_of(napi, struct gro_cell, napi);
>  	struct sk_buff *skb;
>  	int work_done = 0;
> 
> +	spin_lock(&cell->napi_skbs.lock);
>  	while (work_done < budget) {
> -		skb = skb_dequeue(&cell->napi_skbs);
> +		skb = __skb_dequeue(&cell->napi_skbs);
>  		if (!skb)
>  			break;
> -
> +		spin_unlock(&cell->napi_skbs.lock);
>  		napi_gro_receive(napi, skb);
>  		work_done++;
> +		spin_lock(&cell->napi_skbs.lock);
>  	}
> 
>  	if (work_done < budget)
>  		napi_complete(napi);
> +	spin_unlock(&cell->napi_skbs.lock);
>  	return work_done;
>  }
> 
> 
My scenario is working, now
Thanks Eric.

Tested-by: Dmitry Kravkov <dmitry@...adcom.com>