netdev - Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20131203.232122.852236751455974887.davem@davemloft.net>
Date:	Tue, 03 Dec 2013 23:21:22 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	dingtianhong@...wei.com
Cc:	gaofeng@...fujitsu.com, yoshfuji@...ux-ipv6.org, joe@...ches.com,
	vfalico@...hat.com, netdev@...r.kernel.org
Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for
 neigh_timer_handler()

From: Ding Tianhong <dingtianhong@...wei.com>
Date: Wed, 4 Dec 2013 12:04:31 +0800

> The destroying neigh could be trigger by userspace, just like set the ip address which
> in arp table to the local device ip, some I could not control it, it maybe anytime,
> but the timer handler is execute by logic, this is normal, so I think the logic
> is no problem, and the process of destroying neigh may conflict with the timer handler,
> it is a synchronous problem to make sure the timer should be finished before the
> reference neigh is freed.

The more I think about this, the more none of the explanations for this bug
make any sense.

neigh_destroy() _ONLY_ runs when:

	if (atomic_dec_and_test(&neigh->refcnt))

triggers in neigh_release().

This means it triggers if, and only if, neigh_refcnt goes to zero.

If the refcnt goes to zero, NO TIMER can be running.  If the timer is
running, then there refcnt must be at least '1'.

The only plausible theory would be that something is releasing a neigh
too early, when references to the neigh still actually exist.

And that's a bug that should be fixed.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html