lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 28 Apr 2019 10:59:36 -0700 From: Cong Wang <xiyou.wangcong@...il.com> To: Jason Wang <jasowang@...hat.com> Cc: "weiyongjun (A)" <weiyongjun1@...wei.com>, yuehaibing <yuehaibing@...wei.com>, "davem@...emloft.net" <davem@...emloft.net>, "edumazet@...gle.com" <edumazet@...gle.com>, "brouer@...hat.com" <brouer@...hat.com>, "mst@...hat.com" <mst@...hat.com>, "lirongqing@...du.com" <lirongqing@...du.com>, "nicolas.dichtel@...nd.com" <nicolas.dichtel@...nd.com>, "3chas3@...il.com" <3chas3@...il.com>, "wangli39@...du.com" <wangli39@...du.com>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Peter Xu <peterx@...hat.com> Subject: Re: [PATCH] tun: Fix use-after-free in tun_net_xmit On Sun, Apr 28, 2019 at 12:51 AM Jason Wang <jasowang@...hat.com> wrote: > > tun_net_xmit() doesn't have the chance to > > access the change because it holding the rcu_read_lock(). > > > The problem is the following codes: > > > --tun->numqueues; > > ... > > synchronize_net(); > > We need make sure the decrement of tun->numqueues be visible to readers > after synchronize_net(). And in tun_net_xmit(): It doesn't matter at all. Readers are okay to read it even they still use the stale tun->numqueues, as long as the tfile is not freed readers can read whatever they want... The decrement of tun->numqueues is just how we unpublish the old tfile, it is still valid for readers to read it _after_ unpublish, we only need to worry about free, not about unpublish. This is the whole spirit of RCU. You need to rethink about my SOCK_RCU_FREE patch. Thanks.
Powered by blists - more mailing lists