Messages in this thread | | | From | Cong Wang <> | Date | Tue, 30 Apr 2019 16:42:31 -0700 | Subject | Re: [PATCH] tun: Fix use-after-free in tun_net_xmit |
| |
On Mon, Apr 29, 2019 at 10:11 PM weiyongjun (A) <weiyongjun1@huawei.com> wrote: > This patch should not work. The key point is that when detach the queue > with index is equal to tun->numqueues - 1, we do not clear the point > in tun->tfiles: > > static void __tun_detach(...) > { > ... > **** if index == tun->numqueues - 1, nothing changed **** > rcu_assign_pointer(tun->tfiles[index], > tun->tfiles[tun->numqueues - 1]); > .... > }
This is _perfectly_ fine. This is just how we _unpublish_ it, RCU is NOT against unpublish, you keep missing this point.
Think about list_del_rcu(). RCU readers could still read the list entry even _after_ list_del_rcu(), this is perfectly fine, list_del_rcu() just unpublishes the list entry from a global list, kfree_rcu() is the one frees it. So, RCU readers never hate "unpublish", they just hate "free".
> > And after tfile free, xmit have change to get and use the freed file point.
With SOCK_RCU_FREE, it won't be freed until the last reader is gone. This is the fundamental of RCU.
Please, at least look into sk_destruct().
Thanks.
| |