netdev - Re: [Patch net] act_ife: load meta modules before tcf_idr_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200904221419.59ba1125@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Fri, 4 Sep 2020 22:14:19 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     netdev@...r.kernel.org,
        syzbot+80e32b5d1f9923f8ace6@...kaller.appspotmail.com,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Vlad Buslov <vladbu@...lanox.com>,
        Jiri Pirko <jiri@...nulli.us>
Subject: Re: [Patch net] act_ife: load meta modules before
 tcf_idr_check_alloc()

On Thu,  3 Sep 2020 19:10:11 -0700 Cong Wang wrote:
> The following deadlock scenario is triggered by syzbot:
> 
> Thread A:				Thread B:
> tcf_idr_check_alloc()
> ...
> populate_metalist()
>   rtnl_unlock()
> 					rtnl_lock()
> 					...
>   request_module()			tcf_idr_check_alloc()
>   rtnl_lock()
> 
> At this point, thread A is waiting for thread B to release RTNL
> lock, while thread B is waiting for thread A to commit the IDR
> change with tcf_idr_insert() later.
> 
> Break this deadlock situation by preloading ife modules earlier,
> before tcf_idr_check_alloc(), this is fine because we only need
> to load modules we need potentially.
> 
> Reported-and-tested-by: syzbot+80e32b5d1f9923f8ace6@...kaller.appspotmail.com
> Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action")
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: Vlad Buslov <vladbu@...lanox.com>

Vlad, it'd have been nice to see your review tag here.

> Cc: Jiri Pirko <jiri@...nulli.us>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

LGTM, applied and queued for stable, thank you Cong!