netdev - Re: [PATCH net-next 1/5] tcp: Create list of TFO-contexts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Dec 2018 08:04:08 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Christoph Paasch <cpaasch@...le.com>
Cc:     netdev <netdev@...r.kernel.org>, Yuchung Cheng <ycheng@...gle.com>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH net-next 1/5] tcp: Create list of TFO-contexts

On Fri, Dec 14, 2018 at 2:40 PM Christoph Paasch <cpaasch@...le.com> wrote:
>

...

>  int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
>                               void *key, unsigned int len)
>  {
> @@ -96,13 +131,22 @@ error:             kfree(ctx);
>         spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
>         if (sk) {
>                 q = &inet_csk(sk)->icsk_accept_queue.fastopenq;

> +               rcu_assign_pointer(ctx->next, q->ctx);
At this point, ctx is not yet visible, so you do not need a barrier yet
                    ctx->next = q->ctx;


> +               rcu_assign_pointer(q->ctx, ctx);

Note that readers could see 3 contexts in the chain, instead of maximum two.

This means that proc_tcp_fastopen_key() (your 3/5 change) would
overflow an automatic array :

while (ctxt) {
        memcpy(&key[i], ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
        i += 4;
        ctxt = rcu_dereference(ctxt->next);
}


> +
>                 octx = rcu_dereference_protected(q->ctx,
>                         lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
> -               rcu_assign_pointer(q->ctx, ctx);
> +
> +               octx = tcp_fastopen_cut_keypool(octx, &net->ipv4.tcp_fastopen_ctx_lock);
>         } else {
> +               rcu_assign_pointer(ctx->next, net->ipv4.tcp_fastopen_ctx);

same remark here.

> +               rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
> +
>                 octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
>                         lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
> -               rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
> +
> +               octx = tcp_fastopen_cut_keypool(octx,
> +                                               &net->ipv4.tcp_fastopen_ctx_lock);
>         }
>         spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
>
> --
> 2.16.2
>