[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20170824.213210.527936826990864365.davem@davemloft.net>
Date: Thu, 24 Aug 2017 21:32:10 -0700 (PDT)
From: David Miller <davem@...emloft.net>
To: eric.dumazet@...il.com
Cc: netdev@...r.kernel.org, xiyou.wangcong@...il.com, jiri@...nulli.us,
elena.reshetova@...el.com, jhs@...atatu.com
Subject: Re: [PATCH net] net_sched: fix a refcount_t issue with noop_qdisc
From: Eric Dumazet <eric.dumazet@...il.com>
Date: Thu, 24 Aug 2017 21:12:28 -0700
> From: Eric Dumazet <edumazet@...gle.com>
>
> syzkaller reported a refcount_t warning [1]
>
> Issue here is that noop_qdisc refcnt was never really considered as
> a true refcount, since qdisc_destroy() found TCQ_F_BUILTIN set :
>
> if (qdisc->flags & TCQ_F_BUILTIN ||
> !refcount_dec_and_test(&qdisc->refcnt)))
> return;
>
> Meaning that all atomic_inc() we did on noop_qdisc.refcnt were not
> really needed, but harmless until refcount_t came.
>
> To fix this problem, we simply need to not increment noop_qdisc.refcnt,
> since we never decrement it.
>
> [1]
> refcount_t: increment on 0; use-after-free.
...
> Fixes: 7b9364050246 ("net, sched: convert Qdisc.refcnt from atomic_t to refcount_t")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Reshetova, Elena <elena.reshetova@...el.com>
Applied.
Powered by blists - more mailing lists