netdev - Re: [PATCH] mac802154: add a check for slave data list before delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a5e4u35q.fsf@bootlin.com>
Date: Tue, 12 Nov 2024 12:01:21 +0100
From: Miquel Raynal <miquel.raynal@...tlin.com>
To: Lizhi Xu <lizhi.xu@...driver.com>
Cc: <alex.aring@...il.com>,  <davem@...emloft.net>,  <dmantipov@...dex.ru>,
  <edumazet@...gle.com>,  <horms@...nel.org>,  <kuba@...nel.org>,
  <linux-kernel@...r.kernel.org>,  <linux-usb@...r.kernel.org>,
  <linux-wpan@...r.kernel.org>,  <netdev@...r.kernel.org>,
  <pabeni@...hat.com>,  <stefan@...enfreihafen.org>,
  <syzbot+985f827280dc3a6e7e92@...kaller.appspotmail.com>,
  <syzkaller-bugs@...glegroups.com>
Subject: Re: [PATCH] mac802154: add a check for slave data list before delete

On 12/11/2024 at 08:21:33 +08, Lizhi Xu <lizhi.xu@...driver.com> wrote:

> On Mon, 11 Nov 2024 20:46:57 +0100, Miquel Raynal wrote:
>> On 08/11/2024 at 22:54:20 +08, Lizhi Xu <lizhi.xu@...driver.com> wrote:
>> 
>> > syzkaller reported a corrupted list in ieee802154_if_remove. [1]
>> >
>> > Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4
>> > hardware device from the system.
>> >
>> > CPU0					CPU1
>> > ====					====
>> > genl_family_rcv_msg_doit		ieee802154_unregister_hw
>> > ieee802154_del_iface			ieee802154_remove_interfaces
>> > rdev_del_virtual_intf_deprecated	list_del(&sdata->list)
>> > ieee802154_if_remove
>> > list_del_rcu
>> 
>> FYI this is a "duplicate" but with a different approach than:
>> https://lore.kernel.org/linux-wpan/87v7wtpngj.fsf@bootlin.com/T/#m02cebe86ec0171fc4d3350676bbdd4a7e3827077
> No, my patch was the first to fix it, someone else copied my
> patch. Here is my patch:

Ok, so same question as to the other contributor, why not enclosing the
remaining list_del_rcu() within mutex protection? Can we avoid the
creation of the LISTDONE state bit?

Thanks,
Miquèl