From: Divya Indi <divya.indi@oracle.com>
To: "Wan, Kaike" <kaike.wan@intel.com>,
Mark Bloch <markb@mellanox.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>,
Jason Gunthorpe <jgg@ziepe.ca>
Cc: "Gerd Rausch" <gerd.rausch@oracle.com>,
"Håkon Bugge" <haakon.bugge@oracle.com>,
"Srinivas Eeda" <srinivas.eeda@oracle.com>,
"Rama Nichanamatlu" <rama.nichanamatlu@oracle.com>,
"Doug Ledford" <dledford@redhat.com>
Subject: Re: [PATCH 1/2] IB/sa: Resolving use-after-free in ib_nl_send_msg.
Date: Mon, 11 May 2020 14:06:25 -0700 [thread overview]
Message-ID: <54a2c84e-1745-cae5-e0b5-4d63013aef32@oracle.com> (raw)
In-Reply-To: <MW3PR11MB4665120FE43314C22A862324F4A50@MW3PR11MB4665.namprd11.prod.outlook.com>
Hi,
Thanks for taking the time to review. Please find my comments inline -
On 5/7/20 1:16 PM, Wan, Kaike wrote:
>
>> -----Original Message-----
>> From: Mark Bloch <markb@mellanox.com>
>> Sent: Thursday, May 07, 2020 3:36 PM
>> To: Divya Indi <divya.indi@oracle.com>; linux-kernel@vger.kernel.org; linux-
>> rdma@vger.kernel.org; Jason Gunthorpe <jgg@ziepe.ca>; Wan, Kaike
>> <kaike.wan@intel.com>
>> Cc: Gerd Rausch <gerd.rausch@oracle.com>; Håkon Bugge
>> <haakon.bugge@oracle.com>; Srinivas Eeda <srinivas.eeda@oracle.com>;
>> Rama Nichanamatlu <rama.nichanamatlu@oracle.com>; Doug Ledford
>> <dledford@redhat.com>
>> Subject: Re: [PATCH 1/2] IB/sa: Resolving use-after-free in ib_nl_send_msg.
>>
>>
>>> @@ -1123,6 +1156,18 @@ int ib_nl_handle_resolve_resp(struct sk_buff
>>> *skb,
>>>
>>> send_buf = query->mad_buf;
>>>
>>> + /*
>>> + * Make sure the IB_SA_NL_QUERY_SENT flag is set before
>>> + * processing this query. If flag is not set, query can be accessed in
>>> + * another context while setting the flag and processing the query
>> will
>>> + * eventually release it causing a possible use-after-free.
>>> + */
>>> + if (unlikely(!ib_sa_nl_query_sent(query))) {
>> Can't there be a race here where you check the flag (it isn't set) and before
>> you call wait_event() the flag is set and wake_up() is called which means you
>> will wait here forever?
> Should wait_event() catch that? That is, if the flag is not set, wait_event() will sleep until the flag is set.
>
> or worse, a timeout will happen the query will be
>> freed and them some other query will call wake_up() and we have again a
>> use-after-free.
> The request has been deleted from the request list by this time and therefore the timeout should have no impact here.
>
>
>>> + spin_unlock_irqrestore(&ib_nl_request_lock, flags);
>>> + wait_event(wait_queue, ib_sa_nl_query_sent(query));
>> What if there are two queries sent to userspace, shouldn't you check and
>> make sure you got woken up by the right one setting the flag?
> The wait_event() is conditioned on the specific query (ib_sa_nl_query_sent(query)), not on the wait_queue itself.
>
>> Other than that, the entire solution makes it very complicated to reason with
>> (flags set/checked without locking etc) maybe we should just revert and fix it
>> the other way?
> The flag could certainly be set under the lock, which may reduce complications.
We could use a lock or use atomic operations. However, the reason for not doing so was that
we have 1 writer and multiple readers of the IB_SA_NL_QUERY_SENT flag and the readers
wouldnt mind reading a stale value.
Would it still be better to have a lock for this flag?
Thanks,
Divya
>
> Kaike
>
next prev parent reply other threads:[~2020-05-11 21:07 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 18:34 Resolving use-after-free in ib_nl_send_msg Divya Indi
2020-05-07 18:34 ` [PATCH 1/2] IB/sa: " Divya Indi
2020-05-07 19:06 ` Wan, Kaike
2020-05-07 19:36 ` Mark Bloch
2020-05-07 20:16 ` Wan, Kaike
2020-05-07 21:40 ` Mark Bloch
2020-05-11 21:10 ` Divya Indi
2020-05-11 21:06 ` Divya Indi [this message]
2020-05-12 11:15 ` Wan, Kaike
2020-05-08 0:08 ` Jason Gunthorpe
2020-05-11 21:26 ` Divya Indi
2020-05-13 15:00 ` Jason Gunthorpe
2020-05-13 21:02 ` Divya Indi
2020-05-19 23:30 ` Divya Indi
2020-05-20 0:10 ` Jason Gunthorpe
[not found] ` <20200508110302.17872-1-hdanton@sina.com>
2020-05-11 21:30 ` Divya Indi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54a2c84e-1745-cae5-e0b5-4d63013aef32@oracle.com \
--to=divya.indi@oracle.com \
--cc=dledford@redhat.com \
--cc=gerd.rausch@oracle.com \
--cc=haakon.bugge@oracle.com \
--cc=jgg@ziepe.ca \
--cc=kaike.wan@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=markb@mellanox.com \
--cc=rama.nichanamatlu@oracle.com \
--cc=srinivas.eeda@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).