* Possible read of uninitialized array values in reuseport_select_sock?
@ 2021-01-07 3:53 Baptiste Lepers
2021-01-07 4:56 ` Willem de Bruijn
0 siblings, 1 reply; 3+ messages in thread
From: Baptiste Lepers @ 2021-01-07 3:53 UTC (permalink / raw)
To: davem, kuba, willemb, netdev
Hello,
While reading the code of net/core/sock_reuseport.c, I think I found a
possible race in reuseport_select_sock. The current code has the
following pattern:
socks = READ_ONCE(reuse->num_socks);
smp_rmb(); // paired with reuseport_add_sock to make sure
reuse->socks[i < num_socks] are initialized
while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
if (i >= reuse->num_socks) // should be "socks" and not
"reuse->num_socks"?
The barrier seems to be here to make sure that all items of
reuse->socks are initialized before being read, but the barrier only
protects indexes < socks, not indexes < reuse->num_socks.
I have a patch ready to fix this issue, but I wanted to confirm that
the current code is indeed incorrect (if the code is correct for a
non-obvious reason, I'd be happy to add some comments to document the
behavior).
Here is the diff of the patch I was planning to submit:
diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
index bbdd3c7b6cb5..b065f0a103ed 100644
--- a/net/core/sock_reuseport.c
+++ b/net/core/sock_reuseport.c
@@ -293,7 +293,7 @@ struct sock *reuseport_select_sock(struct sock *sk,
i = j = reciprocal_scale(hash, socks);
while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
i++;
- if (i >= reuse->num_socks)
+ if (i >= socks)
i = 0;
if (i == j)
goto out;
Thanks,
Baptiste.
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: Possible read of uninitialized array values in reuseport_select_sock?
2021-01-07 3:53 Possible read of uninitialized array values in reuseport_select_sock? Baptiste Lepers
@ 2021-01-07 4:56 ` Willem de Bruijn
2021-01-07 5:07 ` Baptiste Lepers
0 siblings, 1 reply; 3+ messages in thread
From: Willem de Bruijn @ 2021-01-07 4:56 UTC (permalink / raw)
To: Baptiste Lepers
Cc: David Miller, Jakub Kicinski, Willem de Bruijn, Network Development
On Wed, Jan 6, 2021 at 10:54 PM Baptiste Lepers
<baptiste.lepers@gmail.com> wrote:
>
> Hello,
>
> While reading the code of net/core/sock_reuseport.c, I think I found a
> possible race in reuseport_select_sock. The current code has the
> following pattern:
>
> socks = READ_ONCE(reuse->num_socks);
> smp_rmb(); // paired with reuseport_add_sock to make sure
> reuse->socks[i < num_socks] are initialized
> while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
> if (i >= reuse->num_socks) // should be "socks" and not
> "reuse->num_socks"?
>
> The barrier seems to be here to make sure that all items of
> reuse->socks are initialized before being read, but the barrier only
> protects indexes < socks, not indexes < reuse->num_socks.
>
> I have a patch ready to fix this issue, but I wanted to confirm that
> the current code is indeed incorrect (if the code is correct for a
> non-obvious reason, I'd be happy to add some comments to document the
> behavior).
>
>
> Here is the diff of the patch I was planning to submit:
>
> diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
> index bbdd3c7b6cb5..b065f0a103ed 100644
> --- a/net/core/sock_reuseport.c
> +++ b/net/core/sock_reuseport.c
> @@ -293,7 +293,7 @@ struct sock *reuseport_select_sock(struct sock *sk,
> i = j = reciprocal_scale(hash, socks);
> while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
> i++;
> - if (i >= reuse->num_socks)
> + if (i >= socks)
> i = 0;
> if (i == j)
> goto out;
>
>
> Thanks,
> Baptiste.
Thanks for the clear description. Yes, I believe you're correct.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Possible read of uninitialized array values in reuseport_select_sock?
2021-01-07 4:56 ` Willem de Bruijn
@ 2021-01-07 5:07 ` Baptiste Lepers
0 siblings, 0 replies; 3+ messages in thread
From: Baptiste Lepers @ 2021-01-07 5:07 UTC (permalink / raw)
To: Willem de Bruijn
Cc: David Miller, Jakub Kicinski, Willem de Bruijn, Network Development
Thanks. I will submit a patch.
Baptiste.
On Thu, Jan 7, 2021 at 3:57 PM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> On Wed, Jan 6, 2021 at 10:54 PM Baptiste Lepers
> <baptiste.lepers@gmail.com> wrote:
> >
> > Hello,
> >
> > While reading the code of net/core/sock_reuseport.c, I think I found a
> > possible race in reuseport_select_sock. The current code has the
> > following pattern:
> >
> > socks = READ_ONCE(reuse->num_socks);
> > smp_rmb(); // paired with reuseport_add_sock to make sure
> > reuse->socks[i < num_socks] are initialized
> > while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
> > if (i >= reuse->num_socks) // should be "socks" and not
> > "reuse->num_socks"?
> >
> > The barrier seems to be here to make sure that all items of
> > reuse->socks are initialized before being read, but the barrier only
> > protects indexes < socks, not indexes < reuse->num_socks.
> >
> > I have a patch ready to fix this issue, but I wanted to confirm that
> > the current code is indeed incorrect (if the code is correct for a
> > non-obvious reason, I'd be happy to add some comments to document the
> > behavior).
> >
> >
> > Here is the diff of the patch I was planning to submit:
> >
> > diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
> > index bbdd3c7b6cb5..b065f0a103ed 100644
> > --- a/net/core/sock_reuseport.c
> > +++ b/net/core/sock_reuseport.c
> > @@ -293,7 +293,7 @@ struct sock *reuseport_select_sock(struct sock *sk,
> > i = j = reciprocal_scale(hash, socks);
> > while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
> > i++;
> > - if (i >= reuse->num_socks)
> > + if (i >= socks)
> > i = 0;
> > if (i == j)
> > goto out;
> >
> >
> > Thanks,
> > Baptiste.
>
> Thanks for the clear description. Yes, I believe you're correct.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-07 5:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-07 3:53 Possible read of uninitialized array values in reuseport_select_sock? Baptiste Lepers
2021-01-07 4:56 ` Willem de Bruijn
2021-01-07 5:07 ` Baptiste Lepers
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.