netdev - Re: [PATCH net] net/sched: act_ife: fix recursive lock and idr leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 20 Jun 2018 09:06:38 +0900 (KST)
From:   David Miller <davem@...emloft.net>
To:     dcaratti@...hat.com
Cc:     jhs@...atatu.com, xiyou.wangcong@...il.com, netdev@...r.kernel.org
Subject: Re: [PATCH net] net/sched: act_ife: fix recursive lock and idr leak

From: Davide Caratti <dcaratti@...hat.com>
Date: Tue, 19 Jun 2018 15:39:46 +0200

> a recursive lock warning [1] can be observed with the following script,
 ...
> in case the kernel was unable to run the last command (e.g. because of
> the impossibility to load 'act_meta_skbtcindex'). For a similar reason,
> the kernel can leak idr in the error path of tcf_ife_init(), because
> tcf_idr_release() is not called after successful idr reservation:
 ...
> Since tcfa_lock is already taken when the action is being edited, a call
> to tcf_idr_release() wrongly makes tcf_idr_cleanup() take the same lock
> again. On the other hand, tcf_idr_release() needs to be called in the
> error path of tcf_ife_init(), to undo the last tcf_idr_create() invocation.
> Fix both problems in tcf_ife_init().
> Since the cleanup() routine can now be called when ife->params is NULL,
> also add a NULL pointer check to avoid calling kfree_rcu(NULL, rcu).
> 
>  [1]
 ...
> Fixes: 4e8c86155010 ("net sched: net sched: ife action fix late binding")
> Fixes: ef6980b6becb ("introduce IFE action")
> Signed-off-by: Davide Caratti <dcaratti@...hat.com>

Applied and queued up for -stable.