netdev - Re: [PATCH 1/1] ppp: Fix one deadlock issue of PPP when send frame

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fcdca34b-cfbb-4536-b857-843218645b82@redfish-solutions.com>
Date:   Thu, 18 Aug 2016 10:48:27 -0600
From:   Philp Prindeville <philipp@...fish-solutions.com>
To:     Feng Gao <gfree.wind@...il.com>
Cc:     Gao Feng <fgao@...vckh6395k16k5.yundunddos.com>, paulus@...ba.org,
        linux-ppp@...r.kernel.org,
        Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: [PATCH 1/1] ppp: Fix one deadlock issue of PPP when send frame



On 08/18/2016 09:05 AM, Feng Gao wrote:
> On Thu, Aug 18, 2016 at 10:11 PM, Philp Prindeville
> <philipp@...fish-solutions.com>  wrote:
>> >Feng,
>> >
>> >If the CPU can already be holding the lock, that implies re-entrancy.
>> >What's to stop the first flow of code which acquired the lock from releasing
>> >it again before the 2nd flow is done?  Is the 2nd flow running at a higher
>> >priority or with interrupts disabled?
> There is no preemption happened. It is caused by wrong route policy by l2tp.
> For example, the cpu0 get the spinlock of channel1, then the channel1
> is selected again after route. As a result, cpu0 tries to get the same
> spinlock again.
>
> The call flow is like this.
> ppp_write->ppp_channel_push->start_xmit->select inappropriate route
> .... -> dev_hard_start_xmit->ppp_start_xmit->ppp_xmit_process->
> ppp_push. Now ppp_push tries to get the same spinlock which is held
> in ppp_channel_push.
>
> Regards
> Feng
>

If we're detecting (through the fact that the lock has already been 
acquired) that the wrong route is being applied, why don't we just punt 
the packet instead?

-Philip