netdev - Re: [PATCH net 1/2] net/sched: cls_u32: fix refcount leak in the error path of u32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63fe479d-51cd-eff4-eb13-f0211f694366@mojatatu.com>
Date:   Thu, 19 Dec 2019 11:33:17 -0500
From:   Jamal Hadi Salim <jhs@...atatu.com>
To:     Vlad Buslov <vladbu@...lanox.com>
Cc:     Davide Caratti <dcaratti@...hat.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>, Roman Mashak <mrv@...atatu.com>
Subject: Re: [PATCH net 1/2] net/sched: cls_u32: fix refcount leak in the
 error path of u32_change()

On 2019-12-19 11:15 a.m., Vlad Buslov wrote:


> Hi Jamal,
> 
> Just destroying tp unconditionally will break unlocked case (flower)
> because of possibility of concurrent insertion of new filters to the
> same tp instance.
> 

I was worried about that. So rtnlheld doesnt help?

> The root cause here is precisely described by Davide in cover letter -
> to accommodate concurrent insertions cls API verifies that tp instance
> is empty before deleting it and since there is no cls ops to do it
> directly, it relies on checking that walk() stopped without accessing
> any filters instead. Unfortunately, somw classifier implementations
> assumed that there is always at least one filter on classifier (I fixed
> several of these) and now Davide also uncovered this leak in u32.
> 
> As a simpler solution to fix such issues once and for all I can propose
> not to perform the walk() check at all and assume that any classifier
> implementation that doesn't have TCF_PROTO_OPS_DOIT_UNLOCKED flag set is
> empty in tcf_chain_tp_delete_empty() (there is no possibility of
> concurrent insertion when synchronizing with rtnl).
> 
> WDYT?

IMO that would be a cleaner fix give walk() is used for other
operations and this is a core cls issue.
Also: documenting what it takes for a classifier to support
TCF_PROTO_OPS_DOIT_UNLOCKED is useful (you may have done this
in some commit already).

cheers,
jamal