lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 12 Sep 2018 00:10:02 -0700 (PDT) From: David Miller <davem@...emloft.net> To: xiyou.wangcong@...il.com Cc: netdev@...r.kernel.org, sowmini.varadhan@...cle.com, santosh.shilimkar@...cle.com, rds-devel@....oracle.com Subject: Re: [Patch net v2] rds: fix two RCU related problems From: Cong Wang <xiyou.wangcong@...il.com> Date: Mon, 10 Sep 2018 18:27:26 -0700 > When a rds sock is bound, it is inserted into the bind_hash_table > which is protected by RCU. But when releasing rds sock, after it > is removed from this hash table, it is freed immediately without > respecting RCU grace period. This could cause some use-after-free > as reported by syzbot. > > Mark the rds sock with SOCK_RCU_FREE before inserting it into the > bind_hash_table, so that it would be always freed after a RCU grace > period. > > The other problem is in rds_find_bound(), the rds sock could be > freed in between rhashtable_lookup_fast() and rds_sock_addref(), > so we need to extend RCU read lock protection in rds_find_bound() > to close this race condition. > > Reported-and-tested-by: syzbot+8967084bcac563795dc6@...kaller.appspotmail.com > Reported-by: syzbot+93a5839deb355537440f@...kaller.appspotmail.com > Cc: Sowmini Varadhan <sowmini.varadhan@...cle.com> > Cc: Santosh Shilimkar <santosh.shilimkar@...cle.com> > Cc: rds-devel@....oracle.com > Signed-off-by: Cong Wang <xiyou.wangcong@...il.com> Applied and queued up for -stable, thanks.
Powered by blists - more mailing lists