lkml.org 
[lkml]   [2014]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: net: pptp: bad RCU usage and use after free
On 04/06/2014 03:01 AM, Oleg A. Arkhangelsky wrote:
>
>
> 05.04.2014, 19:53, "Sasha Levin" <sasha.levin@oracle.com>:
>
>> My guess is that we're racing the synchronize_rcu() in del_chan() with
>> the RCU protected read in lookup_chan_dst():
>>
>> pptp_release()
>> del_chan() lookup_chan_dst()
>> enter synchronize_rcu()
>> sock = rcu_dereference(...)
>> exit synchronize_rcu()
>> release_sock()
>> sock_put()
>> opt = &sock->proto.pptp;
>> [ boom ]
>
> Hmm...
>
> IMHO, sock from callid_sock array must be NULL (not uninitialized) at
> that point, because del_chan() do:
>
> RCU_INIT_POINTER(callid_sock[sock->proto.pptp.src_addr.call_id], NULL);
>
> before rcu_synchronize(). I think that prevents access to freeing item
> in subsequent readers that go inside critical section when
> rcu_synchronize() is active.

Right, make sense. I'm completely lost then.


Thanks,
Sasha



\
 
 \ /
  Last update: 2014-04-06 16:41    [W:0.061 / U:0.732 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site