Messages in this thread | | | Date | Sun, 06 Apr 2014 10:01:57 -0400 | From | Sasha Levin <> | Subject | Re: net: pptp: bad RCU usage and use after free |
| |
On 04/06/2014 03:01 AM, Oleg A. Arkhangelsky wrote: > > > 05.04.2014, 19:53, "Sasha Levin" <sasha.levin@oracle.com>: > >> My guess is that we're racing the synchronize_rcu() in del_chan() with >> the RCU protected read in lookup_chan_dst(): >> >> pptp_release() >> del_chan() lookup_chan_dst() >> enter synchronize_rcu() >> sock = rcu_dereference(...) >> exit synchronize_rcu() >> release_sock() >> sock_put() >> opt = &sock->proto.pptp; >> [ boom ] > > Hmm... > > IMHO, sock from callid_sock array must be NULL (not uninitialized) at > that point, because del_chan() do: > > RCU_INIT_POINTER(callid_sock[sock->proto.pptp.src_addr.call_id], NULL); > > before rcu_synchronize(). I think that prevents access to freeing item > in subsequent readers that go inside critical section when > rcu_synchronize() is active.
Right, make sense. I'm completely lost then.
Thanks, Sasha
| |