netdev - Re: [Patch net-next] net_sched: convert idrinfo->lock from spinlock to a mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20181005.003815.1366909058469067585.davem@davemloft.net>
Date:   Fri, 05 Oct 2018 00:38:15 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, jiri@...nulli.us, jhs@...atatu.com,
        vladbu@...lanox.com, idosch@...sch.org, jiri@...lanox.com
Subject: Re: [Patch net-next] net_sched: convert idrinfo->lock from
 spinlock to a mutex

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Tue,  2 Oct 2018 12:50:19 -0700

> In commit ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> we move fl_hw_destroy_tmplt() to a workqueue to avoid blocking
> with the spinlock held. Unfortunately, this causes a lot of
> troubles here:
> 
> 1. tcf_chain_destroy() could be called right after we queue the work
>    but before the work runs. This is a use-after-free.
> 
> 2. The chain refcnt is already 0, we can't even just hold it again.
>    We can check refcnt==1 but it is ugly.
> 
> 3. The chain with refcnt 0 is still visible in its block, which means
>    it could be still found and used!
> 
> 4. The block has a refcnt too, we can't hold it without introducing a
>    proper API either.
> 
> We can make it working but the end result is ugly. Instead of wasting
> time on reviewing it, let's just convert the troubling spinlock to
> a mutex, which allows us to use non-atomic allocations too.
> 
> Fixes: ec3ed293e766 ("net_sched: change tcf_del_walker() to take idrinfo->lock")
> Reported-by: Ido Schimmel <idosch@...sch.org>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Vlad Buslov <vladbu@...lanox.com>
> Cc: Jiri Pirko <jiri@...lanox.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied.