netdev - Re: [patch net-next v6 5/9] genetlink: introduce per-sock family private storage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZXlwY5NxMCEzT/MM@nanopsycho>
Date: Wed, 13 Dec 2023 09:50:43 +0100
From: Jiri Pirko <jiri@...nulli.us>
To: Jakub Kicinski <kuba@...nel.org>
Cc: netdev@...r.kernel.org, pabeni@...hat.com, davem@...emloft.net,
	edumazet@...gle.com, jacob.e.keller@...el.com, jhs@...atatu.com,
	johannes@...solutions.net, andriy.shevchenko@...ux.intel.com,
	amritha.nambiar@...el.com, sdf@...gle.com, horms@...nel.org,
	przemyslaw.kitszel@...el.com
Subject: Re: [patch net-next v6 5/9] genetlink: introduce per-sock family
 private storage

Wed, Dec 13, 2023 at 12:49:38AM CET, kuba@...nel.org wrote:
>On Tue, 12 Dec 2023 11:17:32 +0100 Jiri Pirko wrote:
>> +static void genl_sk_priv_free(struct genl_sk_priv *priv)
>> +{
>> +	spin_lock(&priv->family->sock_priv_list->lock);
>> +	list_del(&priv->list);
>> +	spin_unlock(&priv->family->sock_priv_list->lock);
>> +	if (priv->destructor)
>> +		priv->destructor(priv->priv);
>> +	kfree(priv);
>
>> +static void genl_sk_priv_list_free(const struct genl_family *family)
>> +{
>> +	struct genl_sk_priv *priv, *tmp;
>> +
>> +	if (!family->sock_priv_size)
>> +		return;
>> +
>> +	list_for_each_entry_safe(priv, tmp, &family->sock_priv_list->list, list)
>> +		genl_sk_priv_free(priv);
>> +	kfree(family->sock_priv_list);
>
>Is this not racy for socket close vs family unregister?
>Once family starts to unregister no new privs can be installed
>(on the basis that such family's callbacks can no longer be called).
>But a socket may get closed in the meantime, and we'll end up entering
>genl_sk_priv_free() both from genl_release() and genl_sk_priv_list_free().
>
>Also I'm afraid there is a race still between removing the entry from
>the list and calling destroy.

Moreover, priv is not erased from gsk->family_privs xarray. Sigh, this
is pain.