netdev - Re: [PATCH net-next] net: remove unsafe skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181125.195246.1813633762107745866.davem@davemloft.net>
Date:   Sun, 25 Nov 2018 19:52:46 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     edumazet@...gle.com
Cc:     netdev@...r.kernel.org, eric.dumazet@...il.com,
        faisal.latif@...el.com, dledford@...hat.com, jgg@...pe.ca,
        linux-rdma@...r.kernel.org
Subject: Re: [PATCH net-next] net: remove unsafe skb_insert()

From: Eric Dumazet <edumazet@...gle.com>
Date: Sun, 25 Nov 2018 15:37:43 -0800

> On Sun, Nov 25, 2018 at 10:29 AM David Miller <davem@...emloft.net> wrote:
>>
>> From: Eric Dumazet <edumazet@...gle.com>
>> Date: Sun, 25 Nov 2018 08:26:23 -0800
>>
>> > I do not see how one can effectively use skb_insert() without holding
>> > some kind of lock. Otherwise other cpus could have changed the list
>> > right before we have a chance of acquiring list->lock.
>> >
>> > Only existing user is in drivers/infiniband/hw/nes/nes_mgt.c and this
>> > one probably meant to use __skb_insert() since it appears nesqp->pau_list
>> > is protected by nesqp->pau_lock. This looks like nesqp->pau_lock
>> > could be removed, since nesqp->pau_list.lock could be used instead.
>> >
>> > Signed-off-by: Eric Dumazet <edumazet@...gle.com>
>>
>> Good find.
>>
>> Indeed, any of the queue SKB manipulation functions that take two SKBs
>> as an argument are suspect in this manner.
>>
>> Applied, thanks Eric.
> 
> Oh well, this does not build.
> 
> Since you have not pushed your tree yet, maybe we can replace this
> with a version that actually compiles.
> 
> Please let me know if a relative patch or a v2 is needed, thanks.

I fixed up the build in your original patch and am about to push that
out.