lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 12 Sep 2018 00:10:02 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, sowmini.varadhan@...cle.com,
        santosh.shilimkar@...cle.com, rds-devel@....oracle.com
Subject: Re: [Patch net v2] rds: fix two RCU related problems

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Mon, 10 Sep 2018 18:27:26 -0700

> When a rds sock is bound, it is inserted into the bind_hash_table
> which is protected by RCU. But when releasing rds sock, after it
> is removed from this hash table, it is freed immediately without
> respecting RCU grace period. This could cause some use-after-free
> as reported by syzbot.
> 
> Mark the rds sock with SOCK_RCU_FREE before inserting it into the
> bind_hash_table, so that it would be always freed after a RCU grace
> period.
> 
> The other problem is in rds_find_bound(), the rds sock could be
> freed in between rhashtable_lookup_fast() and rds_sock_addref(),
> so we need to extend RCU read lock protection in rds_find_bound()
> to close this race condition.
> 
> Reported-and-tested-by: syzbot+8967084bcac563795dc6@...kaller.appspotmail.com
> Reported-by: syzbot+93a5839deb355537440f@...kaller.appspotmail.com
> Cc: Sowmini Varadhan <sowmini.varadhan@...cle.com>
> Cc: Santosh Shilimkar <santosh.shilimkar@...cle.com>
> Cc: rds-devel@....oracle.com
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied and queued up for -stable, thanks.

Powered by blists - more mailing lists