Re: net: pptp: bad RCU usage and use after free

[Sasha Levin <sasha.levin@oracle.com>]

On 04/06/2014 03:01 AM, Oleg A. Arkhangelsky wrote:
> 
> 
> 05.04.2014, 19:53, "Sasha Levin" <sasha.levin@oracle.com>:
> 
>> My guess is that we're racing the synchronize_rcu() in del_chan() with
>> the RCU protected read in lookup_chan_dst():
>>
>> pptp_release()
>>         del_chan() lookup_chan_dst()
>>                 enter synchronize_rcu()
>>                                                         sock = rcu_dereference(...)
>>                 exit synchronize_rcu()
>>         release_sock()
>>         sock_put()
>>                                                         opt = &sock->proto.pptp;
>>                                                         [ boom ]
> 
> Hmm...
> 
> IMHO, sock from callid_sock array must be NULL (not uninitialized) at
> that point, because del_chan() do:
> 
> RCU_INIT_POINTER(callid_sock[sock->proto.pptp.src_addr.call_id], NULL);
> 
> before rcu_synchronize(). I think that prevents access to freeing item
> in subsequent readers that go inside critical section when
> rcu_synchronize() is active.

Right, make sense. I'm completely lost then.


Thanks,
Sasha