lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 5 Sep 2013 10:06:03 +0800 From: Ding Tianhong <dingtianhong@...wei.com> To: David Miller <davem@...emloft.net> CC: <vfalico@...hat.com>, <fubar@...ibm.com>, <andy@...yhouse.net>, <nikolay@...hat.com>, <netdev@...r.kernel.org> Subject: Re: [PATCH net-next v2 1/6] bonding: simplify and use RCU protection for 3ad xmit path On 2013/9/5 0:25, David Miller wrote: > From: Veaceslav Falico <vfalico@...hat.com> > Date: Wed, 4 Sep 2013 12:18:24 +0200 > >> On Wed, Sep 04, 2013 at 05:43:45PM +0800, Ding Tianhong wrote: >> ...snip... >>> +/** >>> + * IMPORTANT: bond_first/last_slave_rcu can return NULL in case of an >>> empty list >>> + * Caller must hold rcu_read_lock >>> + */ >>> +#define bond_first_slave_rcu(bond) \ >>> + list_first_or_null_rcu(&(bond)->slave_list, struct slave, list) >>> +#define bond_last_slave_rcu(bond) \ >>> + (list_empty(&(bond)->slave_list) ? NULL : \ >>> + bond_to_slave_rcu((bond)->slave_list.prev)) >> >> Here, bond_last_slave_rcu() is racy. The list can be non-empty when >> list_empty() is verified, however afterwards it might become empty, >> when >> you call bond_to_slave_rcu(), and thus you'll get >> bond_to_slave(bond->slave_list) in the result, which is not a slave. >> >> Take a look at list_first_or_null_rcu() for a reference. The main idea >> is >> that it first gets the ->next pointer, with RCU protection, and then >> verifies if it's the list head or not, and if not - it gets the >> container >> already. This way the ->next pointer won't get away. >> >> These kind of bugs are really rare, but are *EXTREMELY* hard to debug. > > I agree with this analysis. > > Ding, "rcu_read_lock()" doesn't "lock" anything. It's just a memory > barrier. > > All the list can still change on you asynchronously to your accesses. > > That's why list_first_or_null_rcu() is so carefully arranged. > Therefore, you must make similar accomodations. > > > yes, after a long time thinking, I found the problem and know how to do next, repair and resend it later. > . > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists