netdev - Re: [PATCH net] net: Unpublish sk from sk_reuseport_cb before call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20190930.171432.924026195206299750.davem@davemloft.net>
Date:   Mon, 30 Sep 2019 17:14:32 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     kafai@...com
Cc:     netdev@...r.kernel.org, kernel-team@...com, eric.dumazet@...il.com
Subject: Re: [PATCH net] net: Unpublish sk from sk_reuseport_cb before
 call_rcu

From: Martin KaFai Lau <kafai@...com>
Date: Fri, 27 Sep 2019 16:00:31 -0700

> The "reuse->sock[]" array is shared by multiple sockets.  The going away
> sk must unpublish itself from "reuse->sock[]" before making call_rcu()
> call.  However, this unpublish-action is currently done after a grace
> period and it may cause use-after-free.
> 
> The fix is to move reuseport_detach_sock() to sk_destruct().
> Due to the above reason, any socket with sk_reuseport_cb has
> to go through the rcu grace period before freeing it.
> 
> It is a rather old bug (~3 yrs).  The Fixes tag is not necessary
> the right commit but it is the one that introduced the SOCK_RCU_FREE
> logic and this fix is depending on it.
> 
> Fixes: a4298e4522d6 ("net: add SOCK_RCU_FREE socket flag")
> Cc: Eric Dumazet <eric.dumazet@...il.com>
> Suggested-by: Eric Dumazet <eric.dumazet@...il.com>
> Signed-off-by: Martin KaFai Lau <kafai@...com>

Applied and queued up for -stable, thanks Martin.