netdev - Re: A data race between fanout_demux_rollover() and __fanout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJht_EN-7OPijuS4kjqL71tfQHcg_aa9c9SZSQBmSvcNP5fFow@mail.gmail.com>
Date:   Tue, 13 Apr 2021 15:55:21 -0700
From:   Xie He <xie.he.0141@...il.com>
To:     "eyal.birger@...il.com" <eyal.birger@...il.com>,
        "yonatanlinik@...il.com" <yonatanlinik@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "Gong, Sishuai" <sishuai@...due.edu>,
        Willem de Bruijn <willemb@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
Subject: Re: A data race between fanout_demux_rollover() and __fanout_unlink()

On Tue, Apr 13, 2021 at 1:51 PM Gong, Sishuai <sishuai@...due.edu> wrote:
>
> Hi,
>
> We found a data race in linux-5.12-rc3 between af_packet.c functions fanout_demux_rollover() and __fanout_unlink() and we are able to reproduce it under x86.
>
> When the two functions are running together, __fanout_unlink() will grab a lock and modify some attribute of packet_fanout variable, but fanout_demux_rollover() may or may not see this update depending on different interleavings, as shown in below.
>
> Currently, we didn’t find any explicit errors due to this data race. But in fanout_demux_rollover(), we noticed that the data-racing variable is involved in the later operation, which might be a concern.
>
> ------------------------------------------
> Execution interleaving
>
> Thread 1                                                        Thread 2
>
> __fanout_unlink()                                               fanout_demux_rollover()
> spin_lock(&f->lock);
>                                                                         po = pkt_sk(f->arr[idx]);
>                                                                         // po is a out-of-date value
> f->arr[i] = f->arr[f->num_members - 1];
> spin_unlock(&f->lock);
>
>
>
> Thanks,
> Sishuai

CC'ing more people.