lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 10 Mar 2020 10:53:38 -0700
To:     zerons <>
Cc:     netdev <>,
        OFED mailing list <>,
Subject: Re: Maybe a race condition in net/rds/rdma.c?

On 3/6/20 4:11 AM, zerons wrote:
> On 2/28/20 02:10, wrote:
>>>> On 18 Feb 2020, at 14:13, zerons <> wrote:
>>>> Hi, all
>>>> In net/rds/rdma.c
>>>> (*n419__;Iw!!GqivPVa7Brio!OwwQCLtjDsKmhaIz0sfaOVSuC4ai5t5_FgB7yqNExGOCBtACtIGLF61NNJyqSDtIAcGoPg$ ),
>>>> there may be a race condition between rds_rdma_unuse() and rds_free_mr().
>> Hmmm.. I didn't see email before in my inbox. Please post questions/patches on netdev in future which is the correct mailing list.
>>>> It seems that this one need some specific devices to run test,
>>>> unfortunately, I don't have any of these.
>>>> I've already sent two emails to the maintainer for help, no response yet,
>>>> (the email address may not be in use).
>>>> 0) in rds_recv_incoming_exthdrs(), it calls rds_rdma_unuse() when receive an
>>>> extension header with force=0, if the victim mr does not have RDS_RDMA_USE_ONCE
>>>> flag set, then the mr would stay in the rbtree. Without any lock, it tries to
>>>> call mr->r_trans->sync_mr().
MR won't stay in the rbtree with force flag. If the MR is used or
use_once is set in both cases its removed from the tree.
See "if (mr->r_use_once || force)"

>>>> 1) in rds_free_mr(), the same mr is found, and then freed. The mr->r_refcount
>>>> doesn't change while rds_mr_tree_walk().
>>>> 0) back in rds_rdma_unuse(), the victim mr get used again, call
>>>> mr->r_trans->sync_mr().
>>>> Could this race condition actually happen?
So from what I see, this race doesn't exist but let me know
if am missing something.


Powered by blists - more mailing lists