netdev - Re: [Patch net-next] net_sched: convert idrinfo->lock from spinlock to a mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181003053112.GA15357@splinter>
Date:   Wed, 3 Oct 2018 08:31:12 +0300
From:   Ido Schimmel <idosch@...sch.org>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     netdev@...r.kernel.org, jiri@...nulli.us, jhs@...atatu.com,
        vladbu@...lanox.com, Jiri Pirko <jiri@...lanox.com>
Subject: Re: [Patch net-next] net_sched: convert idrinfo->lock from spinlock
 to a mutex

On Tue, Oct 02, 2018 at 12:50:19PM -0700, Cong Wang wrote:
> In commit ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> we move fl_hw_destroy_tmplt() to a workqueue to avoid blocking
> with the spinlock held. Unfortunately, this causes a lot of
> troubles here:
> 
> 1. tcf_chain_destroy() could be called right after we queue the work
>    but before the work runs. This is a use-after-free.
> 
> 2. The chain refcnt is already 0, we can't even just hold it again.
>    We can check refcnt==1 but it is ugly.
> 
> 3. The chain with refcnt 0 is still visible in its block, which means
>    it could be still found and used!
> 
> 4. The block has a refcnt too, we can't hold it without introducing a
>    proper API either.
> 
> We can make it working but the end result is ugly. Instead of wasting
> time on reviewing it, let's just convert the troubling spinlock to
> a mutex, which allows us to use non-atomic allocations too.
> 
> Fixes: ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> Reported-by: Ido Schimmel <idosch@...sch.org>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Vlad Buslov <vladbu@...lanox.com>
> Cc: Jiri Pirko <jiri@...lanox.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Tested-by: Ido Schimmel <idosch@...lanox.com>

Thanks a lot!