From: Hoang Huu Le <hoang.h.le@dektech.com.au>
To: Jon Maloy <jmaloy@redhat.com>, Jakub Kicinski <kuba@kernel.org>
Cc: "maloy@donjonn.com" <maloy@donjonn.com>,
"ying.xue@windriver.com" <ying.xue@windriver.com>,
"tipc-discussion@lists.sourceforge.net"
<tipc-discussion@lists.sourceforge.net>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: RE: [net] tipc: fix NULL pointer dereference in tipc_named_rcv
Date: Fri, 9 Oct 2020 04:12:42 +0000 [thread overview]
Message-ID: <VI1PR05MB46058487F5FE43F6ED539355F1080@VI1PR05MB4605.eurprd05.prod.outlook.com> (raw)
In-Reply-To: <54320213-5b9b-4648-fa6b-553d2acb298e@redhat.com>
Hi Jon, Jakub,
I tried with your comment. But looks like we got into circular locking and deadlock could happen like this:
CPU0 CPU1
---- ----
lock(&n->lock#2);
lock(&tn->nametbl_lock);
lock(&n->lock#2);
lock(&tn->nametbl_lock);
*** DEADLOCK ***
Regards,
Hoang
> -----Original Message-----
> From: Jon Maloy <jmaloy@redhat.com>
> Sent: Friday, October 9, 2020 1:01 AM
> To: Jakub Kicinski <kuba@kernel.org>; Hoang Huu Le <hoang.h.le@dektech.com.au>
> Cc: maloy@donjonn.com; ying.xue@windriver.com; tipc-discussion@lists.sourceforge.net; netdev@vger.kernel.org
> Subject: Re: [net] tipc: fix NULL pointer dereference in tipc_named_rcv
>
>
>
> On 10/8/20 1:25 PM, Jakub Kicinski wrote:
> > On Thu, 8 Oct 2020 14:31:56 +0700 Hoang Huu Le wrote:
> >> diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
> >> index 2f9c148f17e2..fe4edce459ad 100644
> >> --- a/net/tipc/name_distr.c
> >> +++ b/net/tipc/name_distr.c
> >> @@ -327,8 +327,13 @@ static struct sk_buff *tipc_named_dequeue(struct sk_buff_head *namedq,
> >> struct tipc_msg *hdr;
> >> u16 seqno;
> >>
> >> + spin_lock_bh(&namedq->lock);
> >> skb_queue_walk_safe(namedq, skb, tmp) {
> >> - skb_linearize(skb);
> >> + if (unlikely(skb_linearize(skb))) {
> >> + __skb_unlink(skb, namedq);
> >> + kfree_skb(skb);
> >> + continue;
> >> + }
> >> hdr = buf_msg(skb);
> >> seqno = msg_named_seqno(hdr);
> >> if (msg_is_last_bulk(hdr)) {
> >> @@ -338,12 +343,14 @@ static struct sk_buff *tipc_named_dequeue(struct sk_buff_head *namedq,
> >>
> >> if (msg_is_bulk(hdr) || msg_is_legacy(hdr)) {
> >> __skb_unlink(skb, namedq);
> >> + spin_unlock_bh(&namedq->lock);
> >> return skb;
> >> }
> >>
> >> if (*open && (*rcv_nxt == seqno)) {
> >> (*rcv_nxt)++;
> >> __skb_unlink(skb, namedq);
> >> + spin_unlock_bh(&namedq->lock);
> >> return skb;
> >> }
> >>
> >> @@ -353,6 +360,7 @@ static struct sk_buff *tipc_named_dequeue(struct sk_buff_head *namedq,
> >> continue;
> >> }
> >> }
> >> + spin_unlock_bh(&namedq->lock);
> >> return NULL;
> >> }
> >>
> >> diff --git a/net/tipc/node.c b/net/tipc/node.c
> >> index cf4b239fc569..d269ebe382e1 100644
> >> --- a/net/tipc/node.c
> >> +++ b/net/tipc/node.c
> >> @@ -1496,7 +1496,7 @@ static void node_lost_contact(struct tipc_node *n,
> >>
> >> /* Clean up broadcast state */
> >> tipc_bcast_remove_peer(n->net, n->bc_entry.link);
> >> - __skb_queue_purge(&n->bc_entry.namedq);
> >> + skb_queue_purge(&n->bc_entry.namedq);
> > Patch looks fine, but I'm not sure why not hold
> > spin_unlock_bh(&tn->nametbl_lock) here instead?
> >
> > Seems like node_lost_contact() should be relatively rare,
> > so adding another lock to tipc_named_dequeue() is not the
> > right trade off.
> Actually, I agree with previous speaker here. We already have the
> nametbl_lock when tipc_named_dequeue() is called, and the same lock is
> accessible from no.c where node_lost_contact() is executed. The patch
> and the code becomes simpler.
> I suggest you post a v2 of this one.
>
> ///jon
>
> >> /* Abort any ongoing link failover */
> >> for (i = 0; i < MAX_BEARERS; i++) {
next prev parent reply other threads:[~2020-10-09 4:12 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-08 7:31 [net] tipc: fix NULL pointer dereference in tipc_named_rcv Hoang Huu Le
2020-10-08 17:25 ` Jakub Kicinski
2020-10-08 18:00 ` Jon Maloy
2020-10-09 4:12 ` Hoang Huu Le [this message]
2020-10-09 12:47 ` Jon Maloy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=VI1PR05MB46058487F5FE43F6ED539355F1080@VI1PR05MB4605.eurprd05.prod.outlook.com \
--to=hoang.h.le@dektech.com.au \
--cc=jmaloy@redhat.com \
--cc=kuba@kernel.org \
--cc=maloy@donjonn.com \
--cc=netdev@vger.kernel.org \
--cc=tipc-discussion@lists.sourceforge.net \
--cc=ying.xue@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).