netdev - Re: [Patch net] net_sched: close another race condition in tcf_mirred

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <573B09A2.3040206@mojatatu.com>
Date:	Tue, 17 May 2016 08:08:02 -0400
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org
Subject: Re: [Patch net] net_sched: close another race condition in
 tcf_mirred_release()

On 16-05-16 06:11 PM, Cong Wang wrote:
> We saw the following extra refcount release on veth device:
>
>    kernel: [7957821.463992] unregister_netdevice: waiting for mesos50284 to become free. Usage count = -1
>
> Since we heavily use mirred action to redirect packets to veth, I think
> this is caused by the following race condition:
>
> CPU0:
> tcf_mirred_release(): (in RCU callback)
> 	struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);
>
> CPU1:
> mirred_device_event():
>          spin_lock_bh(&mirred_list_lock);
>          list_for_each_entry(m, &mirred_list, tcfm_list) {
>                  if (rcu_access_pointer(m->tcfm_dev) == dev) {
>                          dev_put(dev);
>                          /* Note : no rcu grace period necessary, as
>                           * net_device are already rcu protected.
>                           */
>                          RCU_INIT_POINTER(m->tcfm_dev, NULL);
>                  }
>          }
>          spin_unlock_bh(&mirred_list_lock);
>
> CPU0:
> tcf_mirred_release():
>          spin_lock_bh(&mirred_list_lock);
>          list_del(&m->tcfm_list);
>          spin_unlock_bh(&mirred_list_lock);
>          if (dev)               // <======== Stil refers to the old m->tcfm_dev
>                  dev_put(dev);  // <======== dev_put() is called on it again
>
> The action init code path is good because it is impossible to modify
> an action that is being removed.
>
> So, fix this by moving everything under the spinlock.
>
> Fixes: 2ee22a90c7af ("net_sched: act_mirred: remove spinlock in fast path")
> Fixes: 6bd00b850635 ("act_mirred: fix a race condition on mirred_list")
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

LGTM.
Acked-by: Jamal Hadi Salim <jhs@...atatu.com>


cheers,
jamal