netdev - Re: Fw:[Bug 70471] xfrm policy node will double unlink.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 20 Feb 2014 10:01:19 +0800
From:	"Xianpeng Zhao" <673321875@...com>
To:	"Steffen Klassert" 
	<steffen.klassert@...unet.com>
Cc:	"netdev" <netdev@...r.kernel.org>,
	"alan" <alan@...rguk.ukuu.org.uk>
Subject: Re: Fw:[Bug 70471] xfrm policy node will double unlink.

Sorry, I misunderstood your means in last mail.
    I get your patch now. Later I will use your patch. 

    Now, I am using my patch doing the test, my patch is like this; till now, everything is OK. I think my patch almost same with your patch.

diff --git a/include/linux/list.h b/include/linux/list.h
index cc6d2aa..3a8b95a 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -578,6 +578,11 @@ static inline int hlist_unhashed(const struct hlist_node *h)
 	return !h->pprev;
 }
 
+static inline int hlist_removed(const struct hlist_node *h)
+{
+	return (h->pprev == LIST_POISON2 && h->next == LIST_POISON1);
+}
+
 static inline int hlist_empty(const struct hlist_head *h)
 {
 	return !h->first;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 41eabc4..005be47 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1073,7 +1073,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
 {
 	struct net *net = xp_net(pol);
 
-	if (hlist_unhashed(&pol->bydst))
+	if (hlist_unhashed(&pol->bydst) || hlist_removed(&pol->bydst))
 		return NULL;
 
 	hlist_del(&pol->bydst);


 




------------------ Original ------------------
From:  "Steffen Klassert";<steffen.klassert@...unet.com>;
Date:  Wed, Feb 19, 2014 07:43 PM
To:  "Xianpeng Zhao"<673321875@...com>; 
Cc:  "netdev"<netdev@...r.kernel.org>; "alan"<alan@...rguk.ukuu.org.uk>; 
Subject:  Re: Fw:[Bug 70471] xfrm policy node will double unlink.



On Wed, Feb 19, 2014 at 10:07:14AM +0800, Xianpeng Zhao wrote:
> Hi Steffen,
> 
>       This problem is happened when running stress test; Very little chance can get this case.
> 
>       As you say, add a long time sleep in function xfrm_policy_bysel_ctx between __xfrm_policy_unlink and 
> xfrm_policy_kill, will reproduce this issue manually. 
> 
>       About my patch, I am not sure it is OK, because after it patched, the issue had reproduced once, but after some days test recently, have not reproduced again. 
> 
>       But I can make sure when __xfrm_policy_unlink find the node had been removed, return NULL instead of delete again will fix this problem.
> 
>       What's your suggestions?
> 

Please test the patch I've sent with the last mail.
Thanks!
.