netdev - Re: [RFC PATCH] kcm: hold rx mux lock when updating the receive queue.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180605.105335.458709382920337752.davem@davemloft.net>
Date:   Tue, 05 Jun 2018 10:53:35 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     pabeni@...hat.com
Cc:     netdev@...r.kernel.org, tom@...ntonium.net, ktkhai@...tuozzo.com
Subject: Re: [RFC PATCH] kcm: hold rx mux lock when updating the receive
 queue.

From: Paolo Abeni <pabeni@...hat.com>
Date: Tue,  5 Jun 2018 12:32:33 +0200

> @@ -1157,7 +1158,9 @@ static int kcm_recvmsg(struct socket *sock, struct msghdr *msg,
>  			/* Finished with message */
>  			msg->msg_flags |= MSG_EOR;
>  			KCM_STATS_INCR(kcm->stats.rx_msgs);
> +			spin_lock_bh(&kcm->mux->rx_lock);
>  			skb_unlink(skb, &sk->sk_receive_queue);
> +			spin_unlock_bh(&kcm->mux->rx_lock);

Hmmm, maybe I don't understand the corruption.

But, skb_unlink() takes the sk->sk_receive_queue.lock which should
prevent SKB list corruption.