lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 30 Aug 2016 12:28:07 -0400
From:   "Benjamin Coddington" <bcodding@...hat.com>
To:     "Paolo Abeni" <pabeni@...hat.com>
Cc:     netdev@...r.kernel.org,
        "Trond Myklebust" <trond.myklebust@...marydata.com>,
        "Anna Schumaker" <anna.schumaker@...app.com>,
        "J. Bruce Fields" <bfields@...ldses.org>,
        "Jeff Layton" <jlayton@...chiereds.net>,
        "David S. Miller" <davem@...emloft.net>, linux-nfs@...r.kernel.org,
        "Jan Stancek" <jstancek@...hat.com>
Subject: Re: [PATCH net] sunrpc: fix UDP memory accounting

On 25 Aug 2016, at 12:42, Paolo Abeni wrote:

> The commit f9b2ee714c5c ("SUNRPC: Move UDP receive data path
> into a workqueue context"), as a side effect, moved the
> skb_free_datagram() call outside the scope of the related socket
> lock, but UDP sockets require such lock to be held for proper
> memory accounting.
> Fix it by replacing skb_free_datagram() with
> skb_free_datagram_locked().
>
> Fixes: f9b2ee714c5c ("SUNRPC: Move UDP receive data path into a 
> workqueue context")
> Reported-and-tested-by: Jan Stancek <jstancek@...hat.com>
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>

Thanks for finding this. A similar fix in 2009 for svcsock.c was done by 
Eric Dumazet:
9d410c796067 ("net: fix sk_forward_alloc corruption")

skb_free_datagram_locked() is used for all xprt types in svcsock.c, 
should we use
it for the xs_local_transport as well in xprtsock.c?

Ben

> ---
>  net/sunrpc/xprtsock.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
> index 8ede3bc..bf16883 100644
> --- a/net/sunrpc/xprtsock.c
> +++ b/net/sunrpc/xprtsock.c
> @@ -1074,7 +1074,7 @@ static void xs_udp_data_receive(struct sock_xprt 
> *transport)
>  		skb = skb_recv_datagram(sk, 0, 1, &err);
>  		if (skb != NULL) {
>  			xs_udp_data_read_skb(&transport->xprt, sk, skb);
> -			skb_free_datagram(sk, skb);
> +			skb_free_datagram_locked(sk, skb);
>  			continue;
>  		}
>  		if (!test_and_clear_bit(XPRT_SOCK_DATA_READY, 
> &transport->sock_state))
> -- 
> 1.8.3.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" 
> in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists