* [PATCH net-next v2] netpoll: fix use after free
[not found] <cover.1404857349.git.decot@googlers.com>
@ 2014-07-08 22:14 ` David Decotigny
2014-07-09 3:51 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: David Decotigny @ 2014-07-08 22:14 UTC (permalink / raw)
To: David S. Miller, netdev, linux-kernel
Cc: Eric W. Biederman, Eric Dumazet, Cong Wang, David Decotigny,
Antonio Quartulli, Jiri Pirko
After a bonding master reclaims the netpoll info struct, slaves could
still hold a pointer to the reclaimed data. This patch fixes it: as
soon as netpoll_async_cleanup is called for a slave (eg. when
un-enslaved), we make sure that this slave doesn't point to the data.
Signed-off-by: David Decotigny <decot@googlers.com>
---
Tested:
One way to reproduce the panic is with netconsole: with the script
below run in a loop without this patch. Same procedure with this
patch can run without panic.
CONFIG_NETCONSOLE=m
CONFIG_NETCONSOLE_DYNAMIC=y
Then run in a loop (dual port NIC makes it easier to crash):
ifconfig eth0 192.168.42.4 up
ifconfig eth1 192.168.56.4 up
sleep 10
modprobe -r netconsole
modprobe -r bonding
modprobe netconsole
modprobe bonding mode=4
echo +bond0 > /sys/class/net/bonding_masters
ifconfig bond0 192.168.56.3 up
mkdir /sys/kernel/config/netconsole/blah
echo 0 > /sys/kernel/config/netconsole/blah/enabled
echo bond0 > /sys/kernel/config/netconsole/blah/dev_name
echo 192.168.56.42 > /sys/kernel/config/netconsole/blah/remote_ip
echo 1 > /sys/kernel/config/netconsole/blah/enabled
# npinfo refcnt ->1
ifenslave bond0 eth1
# npinfo refcnt ->2
ifenslave bond0 eth0
# (this should be optional, preventing ndo_cleanup_nepoll below)
# npinfo refcnt ->3
sleep 3
ifenslave -d bond0 eth1
# npinfo refcnt ->2, eth1 keeps ptr to npinfo reclaimed later => garbage
sleep 1
echo -bond0 > /sys/class/net/bonding_masters
# netpoll_cleanup(bond0) + dec(refcnt)
# (should be optional: becomes -> 1 (aka. != 0)
# ==> do not call ndo_cleanup_nepoll)
# try to increase chance of writing garbage onto npinfo:
ls -lR / 2>&1 | tail -30
echo +bond0 > /sys/class/net/bonding_masters
ifconfig bond0 192.168.56.3 up
ifenslave bond0 eth1
# dev_open() called --> netpoll_rx_disable() + npinfo is garbage
# -> down(&ni->dev_lock);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index e33937f..907fb5e 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -822,7 +822,8 @@ void __netpoll_cleanup(struct netpoll *np)
RCU_INIT_POINTER(np->dev->npinfo, NULL);
call_rcu_bh(&npinfo->rcu, rcu_cleanup_netpoll_info);
- }
+ } else
+ RCU_INIT_POINTER(np->dev->npinfo, NULL);
}
EXPORT_SYMBOL_GPL(__netpoll_cleanup);
--
2.0.0.526.g5318336
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next v2] netpoll: fix use after free
2014-07-08 22:14 ` [PATCH net-next v2] netpoll: fix use after free David Decotigny
@ 2014-07-09 3:51 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2014-07-09 3:51 UTC (permalink / raw)
To: decot; +Cc: netdev, linux-kernel, ebiederm, edumazet, amwang, antonio, jpirko
From: David Decotigny <decot@googlers.com>
Date: Tue, 8 Jul 2014 15:14:41 -0700
> After a bonding master reclaims the netpoll info struct, slaves could
> still hold a pointer to the reclaimed data. This patch fixes it: as
> soon as netpoll_async_cleanup is called for a slave (eg. when
> un-enslaved), we make sure that this slave doesn't point to the data.
>
> Signed-off-by: David Decotigny <decot@googlers.com>
Applied, thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-07-09 3:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <cover.1404857349.git.decot@googlers.com>
2014-07-08 22:14 ` [PATCH net-next v2] netpoll: fix use after free David Decotigny
2014-07-09 3:51 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.