* [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc()
@ 2018-01-16 9:31 Kirill Tkhai
2018-01-16 9:31 ` [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id() Kirill Tkhai
2018-01-17 20:43 ` [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() David Miller
0 siblings, 2 replies; 4+ messages in thread
From: Kirill Tkhai @ 2018-01-16 9:31 UTC (permalink / raw)
To: netdev; +Cc: davem, eric.dumazet, ebiederm, ktkhai
peernet2id_alloc() is racy without rtnl_lock() as refcount_read(&peer->count)
under net->nsid_lock does not guarantee, peer is alive:
rcu_read_lock()
peernet2id_alloc() ..
spin_lock_bh(&net->nsid_lock) ..
refcount_read(&peer->count) (!= 0) ..
.. put_net()
.. cleanup_net()
.. for_each_net(tmp)
.. spin_lock_bh(&tmp->nsid_lock)
.. __peernet2id(tmp, net) == -1
.. ..
.. ..
__peernet2id_alloc(alloc == true) ..
.. ..
rcu_read_unlock() ..
.. synchronize_rcu()
.. kmem_cache_free(net)
After the above situation, net::netns_id contains id pointing to freed memory,
and any other dereferencing by the id will operate with this freed memory.
Currently, peernet2id_alloc() is used under rtnl_lock() everywhere except
ovs_vport_cmd_fill_info(), and this race can't occur. But peernet2id_alloc()
is generic interface, and better we fix it before someone really starts
use it in wrong context.
v2: Don't place refcount_read(&net->count) under net->nsid_lock
as suggested by Eric W. Biederman <ebiederm@xmission.com>
v3: Rebase on top of net-next
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
---
net/core/net_namespace.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 2213d45fcafd..3c77d84ad60d 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -221,17 +221,26 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id);
*/
int peernet2id_alloc(struct net *net, struct net *peer)
{
- bool alloc;
+ bool alloc = false, alive = false;
int id;
if (refcount_read(&net->count) == 0)
return NETNSA_NSID_NOT_ASSIGNED;
spin_lock_bh(&net->nsid_lock);
- alloc = refcount_read(&peer->count) == 0 ? false : true;
+ /*
+ * When peer is obtained from RCU lists, we may race with
+ * its cleanup. Check whether it's alive, and this guarantees
+ * we never hash a peer back to net->netns_ids, after it has
+ * just been idr_remove()'d from there in cleanup_net().
+ */
+ if (maybe_get_net(peer))
+ alive = alloc = true;
id = __peernet2id_alloc(net, peer, &alloc);
spin_unlock_bh(&net->nsid_lock);
if (alloc && id >= 0)
rtnl_net_notifyid(net, RTM_NEWNSID, id);
+ if (alive)
+ put_net(peer);
return id;
}
EXPORT_SYMBOL_GPL(peernet2id_alloc);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id()
2018-01-16 9:31 [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() Kirill Tkhai
@ 2018-01-16 9:31 ` Kirill Tkhai
2018-01-17 20:43 ` David Miller
2018-01-17 20:43 ` [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Kirill Tkhai @ 2018-01-16 9:31 UTC (permalink / raw)
To: netdev; +Cc: davem, eric.dumazet, ebiederm, ktkhai
idr_find() is safe under rcu_read_lock() and
maybe_get_net() guarantees that net is alive.
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
---
net/core/net_namespace.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 3c77d84ad60d..1ccb953b3b09 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -273,11 +273,9 @@ struct net *get_net_ns_by_id(struct net *net, int id)
return NULL;
rcu_read_lock();
- spin_lock_bh(&net->nsid_lock);
peer = idr_find(&net->netns_ids, id);
if (peer)
peer = maybe_get_net(peer);
- spin_unlock_bh(&net->nsid_lock);
rcu_read_unlock();
return peer;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc()
2018-01-16 9:31 [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() Kirill Tkhai
2018-01-16 9:31 ` [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id() Kirill Tkhai
@ 2018-01-17 20:43 ` David Miller
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2018-01-17 20:43 UTC (permalink / raw)
To: ktkhai; +Cc: netdev, eric.dumazet, ebiederm
From: Kirill Tkhai <ktkhai@virtuozzo.com>
Date: Tue, 16 Jan 2018 12:31:41 +0300
> peernet2id_alloc() is racy without rtnl_lock() as refcount_read(&peer->count)
> under net->nsid_lock does not guarantee, peer is alive:
>
> rcu_read_lock()
> peernet2id_alloc() ..
> spin_lock_bh(&net->nsid_lock) ..
> refcount_read(&peer->count) (!= 0) ..
> .. put_net()
> .. cleanup_net()
> .. for_each_net(tmp)
> .. spin_lock_bh(&tmp->nsid_lock)
> .. __peernet2id(tmp, net) == -1
> .. ..
> .. ..
> __peernet2id_alloc(alloc == true) ..
> .. ..
> rcu_read_unlock() ..
> .. synchronize_rcu()
> .. kmem_cache_free(net)
>
> After the above situation, net::netns_id contains id pointing to freed memory,
> and any other dereferencing by the id will operate with this freed memory.
>
> Currently, peernet2id_alloc() is used under rtnl_lock() everywhere except
> ovs_vport_cmd_fill_info(), and this race can't occur. But peernet2id_alloc()
> is generic interface, and better we fix it before someone really starts
> use it in wrong context.
>
> v2: Don't place refcount_read(&net->count) under net->nsid_lock
> as suggested by Eric W. Biederman <ebiederm@xmission.com>
> v3: Rebase on top of net-next
>
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Applied to net-next.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id()
2018-01-16 9:31 ` [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id() Kirill Tkhai
@ 2018-01-17 20:43 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2018-01-17 20:43 UTC (permalink / raw)
To: ktkhai; +Cc: netdev, eric.dumazet, ebiederm
From: Kirill Tkhai <ktkhai@virtuozzo.com>
Date: Tue, 16 Jan 2018 12:31:54 +0300
> idr_find() is safe under rcu_read_lock() and
> maybe_get_net() guarantees that net is alive.
>
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Also applied to net-next, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-01-17 20:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-16 9:31 [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() Kirill Tkhai
2018-01-16 9:31 ` [PATCH v3 2/2] net: Remove spinlock from get_net_ns_by_id() Kirill Tkhai
2018-01-17 20:43 ` David Miller
2018-01-17 20:43 ` [PATCH v3 1/2] net: Fix possible race in peernet2id_alloc() David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.