Messages in this thread | | | Date | Fri, 1 Jul 2022 19:41:55 -0700 | From | Jakub Kicinski <> | Subject | Re: [PATCH v4] net: rose: fix null-ptr-deref caused by rose_kill_by_neigh |
| |
On Wed, 29 Jun 2022 18:49:41 +0800 Duoming Zhou wrote: > When the link layer connection is broken, the rose->neighbour is > set to null. But rose->neighbour could be used by rose_connection() > and rose_release() later, because there is no synchronization among > them. As a result, the null-ptr-deref bugs will happen. > > One of the null-ptr-deref bugs is shown below: > > (thread 1) | (thread 2) > | rose_connect > rose_kill_by_neigh | lock_sock(sk) > spin_lock_bh(&rose_list_lock) | if (!rose->neighbour) > rose->neighbour = NULL;//(1) | > | rose->neighbour->use++;//(2)
> if (rose->neighbour == neigh) {
Why is it okay to perform this comparison without the socket lock, if we need a socket lock to clear it? Looks like rose_kill_by_neigh() is not guaranteed to clear all the uses of a neighbor.
> + sock_hold(s); > + spin_unlock_bh(&rose_list_lock); > + lock_sock(s); > rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); > rose->neighbour->use--;
What protects the use counter?
> rose->neighbour = NULL; > + release_sock(s); > + spin_lock_bh(&rose_list_lock);
Don't take the lock here just dump one line further back.
> + sock_put(s); > + goto again; > } > } > spin_unlock_bh(&rose_list_lock); > diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c > index fee6409c2bb..b116828b422 100644 > --- a/net/rose/rose_route.c > +++ b/net/rose/rose_route.c > @@ -827,7 +827,9 @@ void rose_link_failed(ax25_cb *ax25, int reason) > ax25_cb_put(ax25); > > rose_del_route_by_neigh(rose_neigh); > + spin_unlock_bh(&rose_neigh_list_lock); > rose_kill_by_neigh(rose_neigh); > + return; > } > spin_unlock_bh(&rose_neigh_list_lock); > }
| |