netdev - Re: [PATCH v3 net] tcp/dccp: fix other lockdep splats accessing ireq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20171026.174213.476814979488104324.davem@davemloft.net>
Date:   Thu, 26 Oct 2017 17:42:13 +0900 (KST)
From:   David Miller <davem@...emloft.net>
To:     eric.dumazet@...il.com
Cc:     fengguang.wu@...el.com, netdev@...r.kernel.org
Subject: Re: [PATCH v3 net] tcp/dccp: fix other lockdep splats accessing
 ireq_opt

From: Eric Dumazet <eric.dumazet@...il.com>
Date: Tue, 24 Oct 2017 08:20:31 -0700

> From: Eric Dumazet <edumazet@...gle.com>
> 
> In my first attempt to fix the lockdep splat, I forgot we could
> enter inet_csk_route_req() with a freshly allocated request socket,
> for which refcount has not yet been elevated, due to complex
> SLAB_TYPESAFE_BY_RCU rules.
> 
> We either are in rcu_read_lock() section _or_ we own a refcount on the
> request.
> 
> Correct RCU verb to use here is rcu_dereference_check(), although it is
> not possible to prove we actually own a reference on a shared
> refcount :/
> 
> In v2, I added ireq_opt_deref() helper and use in three places, to fix other
> possible splats.
 ...
> Fixes: a6ca7abe53633 ("tcp/dccp: fix lockdep splat in inet_csk_route_req()")
> Fixes: c92e8c02fe66 ("tcp/dccp: fix ireq->opt races")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: kernel test robot <fengguang.wu@...el.com>
> Reported-by: Maciej Żenczykowski <maze@...gle.com>
> ---
> v3: fix typo in predicate

Applied and queued up for -stable.