Re: net: use-after-free in worker_thread

From	Herbert Xu <herbert@gondor.apana.org.au>
Newsgroups	linux.kernel
Subject	Re: net: use-after-free in worker_thread
Date	2016-12-05 08:30 +0100
Message-ID	<sKVSN-1tp-13@gated-at.bofh.it> (permalink)
References	<sKi54-1eT-9@gated-at.bofh.it> <sKieK-1BX-19@gated-at.bofh.it> <sKieK-1BX-23@gated-at.bofh.it> <sKj17-24l-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Dec 03, 2016 at 05:49:07AM -0800, Eric Dumazet wrote:
>
> @@ -600,6 +600,7 @@ static int __netlink_create(struct net *net, struct socket *sock,
>  	}
>  	init_waitqueue_head(&nlk->wait);
>  
> +	sock_set_flag(sk, SOCK_RCU_FREE);
>  	sk->sk_destruct = netlink_sock_destruct;
>  	sk->sk_protocol = protocol;
>  	return 0;

It's not necessarily a big deal but I just wanted to point out
that SOCK_RCU_FREE is not equivalent to the call_rcu thing that
netlink does.  The latter only does the RCU deferral for the socket
release call which is the only place where it's needed while
SOCK_RCU_FREE will force every path to do an RCU deferral.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Thread

net: use-after-free in worker_thread Andrey Konovalov <andreyknvl@google.com> - 2016-12-03 14:00 +0100
  Re: net: use-after-free in worker_thread Andrey Konovalov <andreyknvl@google.com> - 2016-12-03 14:10 +0100
    Re: net: use-after-free in worker_thread Eric Dumazet <eric.dumazet@gmail.com> - 2016-12-03 15:00 +0100
      Re: net: use-after-free in worker_thread Andrey Konovalov <andreyknvl@google.com> - 2016-12-03 16:40 +0100
      Re: net: use-after-free in worker_thread Herbert Xu <herbert@gondor.apana.org.au> - 2016-12-05 08:30 +0100
  Re: net: use-after-free in worker_thread Andrey Konovalov <andreyknvl@google.com> - 2016-12-03 14:10 +0100
  Re: net: use-after-free in worker_thread Cong Wang <xiyou.wangcong@gmail.com> - 2016-12-03 18:50 +0100
    Re: net: use-after-free in worker_thread Cong Wang <xiyou.wangcong@gmail.com> - 2016-12-03 19:20 +0100
      [v2 PATCH] netlink: Do not schedule work from sk_destruct Herbert Xu <herbert@gondor.apana.org.au> - 2016-12-05 08:30 +0100
        [v3 PATCH] netlink: Do not schedule work from sk_destruct Herbert Xu <herbert@gondor.apana.org.au> - 2016-12-05 09:10 +0100
          Re: [v3 PATCH] netlink: Do not schedule work from sk_destruct Andrey Konovalov <andreyknvl@google.com> - 2016-12-05 13:00 +0100
          Re: [v3 PATCH] netlink: Do not schedule work from sk_destruct David Miller <davem@davemloft.net> - 2016-12-06 01:50 +0100
      Re: net: use-after-free in worker_thread Herbert Xu <herbert@gondor.apana.org.au> - 2016-12-05 08:30 +0100

csiph-web