netdev - Re: [Patch net] net_sched: remove tcf_block_put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171031.110655.1489377013029699670.davem@davemloft.net>
Date:   Tue, 31 Oct 2017 11:06:55 +0900 (KST)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, daniel@...earbox.net, jiri@...nulli.us,
        john.fastabend@...il.com, jhs@...atatu.com,
        paulmck@...ux.vnet.ibm.com, edumazet@...gle.com
Subject: Re: [Patch net] net_sched: remove tcf_block_put_deferred()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Mon, 30 Oct 2017 11:10:09 -0700

> In commit 7aa0045dadb6 ("net_sched: introduce a workqueue for RCU callbacks of tc filter")
> I defer tcf_chain_flush() to a workqueue, this causes a use-after-free
> because qdisc is already destroyed after we queue this work.
> 
> The tcf_block_put_deferred() is no longer necessary after we get RTNL
> for each tc filter destroy work, no others could jump in at this point.
> Same for tcf_chain_hold(), we are fully serialized now.
> 
> This also reduces one indirection therefore makes the code more
> readable. Note this brings back a rcu_barrier(), however comparing
> to the code prior to commit 7aa0045dadb6 we still reduced one
> rcu_barrier(). For net-next, we can consider to refcnt tcf block to
> avoid it.
> 
> Fixes: 7aa0045dadb6 ("net_sched: introduce a workqueue for RCU callbacks of tc filter")
> Cc: Daniel Borkmann <daniel@...earbox.net>
> Cc: Jiri Pirko <jiri@...nulli.us>
> Cc: John Fastabend <john.fastabend@...il.com>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
> Cc: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied, thanks for fixing this use-after-free so quickly.

This will be another fun merge into net-next :-)