lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 10 Aug 2020 21:07:52 -0700
From:   Cong Wang <>
To:     Tonghao Zhang <>
Cc:     "Paul E . McKenney" <>,
        Joel Fernandes <>,
        Johan Knöös <>,
        Gregory Rose <>,
        bugs <>, Netdev <>,
        "Uladzislau Rezki (Sony)" <>,
        rcu <>
Subject: Re: [ovs-discuss] Double free in recent kernels after memleak fix

On Mon, Aug 10, 2020 at 8:27 PM Tonghao Zhang <> wrote:
> On Tue, Aug 11, 2020 at 10:24 AM Cong Wang <> wrote:
> >
> > On Mon, Aug 10, 2020 at 6:16 PM Tonghao Zhang <> wrote:
> > > Hi all, I send a patch to fix this. The rcu warnings disappear. I
> > > don't reproduce the double free issue.
> > > But I guess this patch may address this issue.
> > >
> > >
> >
> > I don't see how your patch address the double-free, as we still
> > free mask array twice after your patch: once in tbl_mask_array_realloc()
> > and once in ovs_flow_tbl_destroy().
> Hi Cong.
> Before my patch, we use the ovsl_dereference
> (rcu_dereference_protected) in the rcu callback.
> ovs_flow_tbl_destroy
> ->table_instance_destroy
> ->table_instance_flow_free
> ->flow_mask_remove
> ASSERT_OVSL(will print warning)
> ->tbl_mask_array_del_mask
> ovsl_dereference(rcu usage warning)

I understand how your patch addresses the RCU annotation issue,
which is different from double-free.

> so we should invoke the table_instance_destroy or others under
> ovs_lock to avoid (ASSERT_OVSL and rcu usage warning).

Of course... I never doubt it.

> with this patch, we reallocate the mask_array under ovs_lock, and free
> it in the rcu callback. Without it, we  reallocate and free it in the
> rcu callback.
> I think we may fix it with this patch.

Does it matter which context tbl_mask_array_realloc() is called?
Even with ovs_lock, we can still double free:

 => call_rcu(&old->rcu, mask_array_rcu_cb);
 => call_rcu(&old->rcu, mask_array_rcu_cb);

So still twice, right? To fix the double-free, we have to eliminate one
of them, don't we? ;)

> > Have you tried my patch which is supposed to address this double-free?
> I don't reproduce it. but your patch does not avoid ruc usage warning

Sure, I never intend to fix anything else but double-free. The $subject is
about double free, I double checked. ;)


Powered by blists - more mailing lists