Messages in this thread | | | From | Cong Wang <> | Date | Sun, 28 Apr 2019 10:59:36 -0700 | Subject | Re: [PATCH] tun: Fix use-after-free in tun_net_xmit |
| |
On Sun, Apr 28, 2019 at 12:51 AM Jason Wang <jasowang@redhat.com> wrote: > > tun_net_xmit() doesn't have the chance to > > access the change because it holding the rcu_read_lock(). > > > The problem is the following codes: > > > --tun->numqueues; > > ... > > synchronize_net(); > > We need make sure the decrement of tun->numqueues be visible to readers > after synchronize_net(). And in tun_net_xmit():
It doesn't matter at all. Readers are okay to read it even they still use the stale tun->numqueues, as long as the tfile is not freed readers can read whatever they want...
The decrement of tun->numqueues is just how we unpublish the old tfile, it is still valid for readers to read it _after_ unpublish, we only need to worry about free, not about unpublish. This is the whole spirit of RCU.
You need to rethink about my SOCK_RCU_FREE patch.
Thanks.
| |