lkml.org 
[lkml]   [2022]   [Jul]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v4] net: rose: fix null-ptr-deref caused by rose_kill_by_neigh
Hello,

On Fri, 1 Jul 2022 19:41:55 -0700 Jakub Kicinski wrote:

> On Wed, 29 Jun 2022 18:49:41 +0800 Duoming Zhou wrote:
> > When the link layer connection is broken, the rose->neighbour is
> > set to null. But rose->neighbour could be used by rose_connection()
> > and rose_release() later, because there is no synchronization among
> > them. As a result, the null-ptr-deref bugs will happen.
> >
> > One of the null-ptr-deref bugs is shown below:
> >
> > (thread 1) | (thread 2)
> > | rose_connect
> > rose_kill_by_neigh | lock_sock(sk)
> > spin_lock_bh(&rose_list_lock) | if (!rose->neighbour)
> > rose->neighbour = NULL;//(1) |
> > | rose->neighbour->use++;//(2)
>
> > if (rose->neighbour == neigh) {
>
> Why is it okay to perform this comparison without the socket lock,
> if we need a socket lock to clear it? Looks like rose_kill_by_neigh()
> is not guaranteed to clear all the uses of a neighbor.

I am sorry, the comparision should also be protected with socket lock.
The rose_kill_by_neigh() only clear the neighbor that is passed as
parameter of rose_kill_by_neigh().

> > + sock_hold(s);
> > + spin_unlock_bh(&rose_list_lock);
> > + lock_sock(s);
> > rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
> > rose->neighbour->use--;
>
> What protects the use counter?

The use coounter is protected by socket lock.

> > rose->neighbour = NULL;
> > + release_sock(s);
> > + spin_lock_bh(&rose_list_lock);
>
> Don't take the lock here just dump one line further back.

Ok, I will dump one line further back.

Best regards,
Duoming Zhou
\
 
 \ /
  Last update: 2022-07-02 09:25    [W:0.034 / U:0.544 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site