netdev - Re: [PATCH net] net_sched: fix a refcount_t issue with noop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 24 Aug 2017 21:32:10 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     eric.dumazet@...il.com
Cc:     netdev@...r.kernel.org, xiyou.wangcong@...il.com, jiri@...nulli.us,
        elena.reshetova@...el.com, jhs@...atatu.com
Subject: Re: [PATCH net] net_sched: fix a refcount_t issue with noop_qdisc

From: Eric Dumazet <eric.dumazet@...il.com>
Date: Thu, 24 Aug 2017 21:12:28 -0700

> From: Eric Dumazet <edumazet@...gle.com>
> 
> syzkaller reported a refcount_t warning [1]
> 
> Issue here is that noop_qdisc refcnt was never really considered as
> a true refcount, since qdisc_destroy() found TCQ_F_BUILTIN set :
> 
> if (qdisc->flags & TCQ_F_BUILTIN ||
>     !refcount_dec_and_test(&qdisc->refcnt)))
> 	return;
> 
> Meaning that all atomic_inc() we did on noop_qdisc.refcnt were not
> really needed, but harmless until refcount_t came.
> 
> To fix this problem, we simply need to not increment noop_qdisc.refcnt,
> since we never decrement it.
> 
> [1]
> refcount_t: increment on 0; use-after-free.
 ...
> Fixes: 7b9364050246 ("net, sched: convert Qdisc.refcnt from atomic_t to refcount_t")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Reshetova, Elena <elena.reshetova@...el.com>

Applied.