All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
To: Cong Wang <xiyou.wangcong@gmail.com>
Cc: netdev@vger.kernel.org,
	Santosh Shilimkar <santosh.shilimkar@oracle.com>,
	rds-devel@oss.oracle.com
Subject: Re: [Patch net] rds: mark bound socket with SOCK_RCU_FREE
Date: Mon, 10 Sep 2018 18:34:12 -0400	[thread overview]
Message-ID: <20180910223412.GI4668@oracle.com> (raw)
In-Reply-To: <20180910222422.19470-1-xiyou.wangcong@gmail.com>

On (09/10/18 15:24), Cong Wang wrote:
> 
> When a rds sock is bound, it is inserted into the bind_hash_table
> which is protected by RCU. But when releasing rd sock, after it
> is removed from this hash table, it is freed immediately without
> respecting RCU grace period. This could cause some use-after-free
> as reported by syzbot.
> 

I have no objection to the change itself, but the syzbot failures
are caused for a very simple reason: we need synchronize_net()
in rds_release before we remove the rds_sock from the bind_hash_table.

I already pointed this out in 
  https://www.spinics.net/lists/netdev/msg475074.html

I think the objection to synchronize_net() is that it can cause
perf issues (I'm told that rds_release() has been known to be held
up by other threads in rcu critical sections?) but I personally
dont see any other alternative to this (other than going back
to rwlock, instead of rcu)

--Sowmini

  reply	other threads:[~2018-09-11  3:30 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-10 22:24 [Patch net] rds: mark bound socket with SOCK_RCU_FREE Cong Wang
2018-09-10 22:34 ` Sowmini Varadhan [this message]
2018-09-10 22:43 ` Santosh Shilimkar
2018-09-10 23:30   ` Sowmini Varadhan
2018-09-10 23:51     ` Cong Wang
2018-09-11  0:04       ` Sowmini Varadhan
2018-09-11  0:16         ` Cong Wang
2018-09-11  0:24           ` Sowmini Varadhan
2018-09-11  0:39             ` Cong Wang
2018-09-11  0:26           ` Santosh Shilimkar
2018-09-11  0:45             ` Cong Wang
2018-09-11  0:56               ` Santosh Shilimkar
2018-09-11  0:59                 ` Cong Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180910223412.GI4668@oracle.com \
    --to=sowmini.varadhan@oracle.com \
    --cc=netdev@vger.kernel.org \
    --cc=rds-devel@oss.oracle.com \
    --cc=santosh.shilimkar@oracle.com \
    --cc=xiyou.wangcong@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.