lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 3 Oct 2018 08:31:12 +0300
From:   Ido Schimmel <>
To:     Cong Wang <>
Cc:,,,, Jiri Pirko <>
Subject: Re: [Patch net-next] net_sched: convert idrinfo->lock from spinlock
 to a mutex

On Tue, Oct 02, 2018 at 12:50:19PM -0700, Cong Wang wrote:
> In commit ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> we move fl_hw_destroy_tmplt() to a workqueue to avoid blocking
> with the spinlock held. Unfortunately, this causes a lot of
> troubles here:
> 1. tcf_chain_destroy() could be called right after we queue the work
>    but before the work runs. This is a use-after-free.
> 2. The chain refcnt is already 0, we can't even just hold it again.
>    We can check refcnt==1 but it is ugly.
> 3. The chain with refcnt 0 is still visible in its block, which means
>    it could be still found and used!
> 4. The block has a refcnt too, we can't hold it without introducing a
>    proper API either.
> We can make it working but the end result is ugly. Instead of wasting
> time on reviewing it, let's just convert the troubling spinlock to
> a mutex, which allows us to use non-atomic allocations too.
> Fixes: ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> Reported-by: Ido Schimmel <>
> Cc: Jamal Hadi Salim <>
> Cc: Vlad Buslov <>
> Cc: Jiri Pirko <>
> Signed-off-by: Cong Wang <>

Tested-by: Ido Schimmel <>

Thanks a lot!

Powered by blists - more mailing lists