netdev - Re: [PATCH 0/2] rhashtable: Arbitrary rehashing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150313015410.GA28133@gondor.apana.org.au>
Date:	Fri, 13 Mar 2015 12:54:10 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Thomas Graf <tgraf@...g.ch>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	josh@...htriplett.org,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
Subject: Re: [PATCH 0/2] rhashtable: Arbitrary rehashing

On Thu, Mar 12, 2015 at 04:46:35PM +0000, Thomas Graf wrote:
> On 03/10/15 at 09:26am, Herbert Xu wrote:
> > I have tested it using netlink but obviously more testing especially
> > using netfilter would be welcome.
> 
> I ran the attached bind_netlink test written by Ying Xue and it
> currently crashes with:
> 
> [  108.693908] BUG: unable to handle kernel paging request at fffffffffffffe68

Oops, thanks for testing and finding this bug.

This patch should cure it.

---8<---
rhashtable: Fix read-side crash during rehash
    
This patch fixes a typo rhashtable_lookup_compare where we fail
to recompute the hash when looking up the new table.  This causes
elements to be missed and potentially a crash during a resize.

Reported-by: Thomas Graf <tgraf@...g.ch>
Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>

diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9666efec..f8c5063 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -614,8 +614,8 @@ void *rhashtable_lookup_compare(struct rhashtable *ht, const void *key,
 	rcu_read_lock();
 
 	tbl = rht_dereference_rcu(ht->tbl, ht);
-	hash = key_hashfn(ht, tbl, key);
 restart:
+	hash = key_hashfn(ht, tbl, key);
 	rht_for_each_rcu(he, tbl, hash) {
 		if (!compare(rht_obj(ht, he), arg))
 			continue;

-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html