From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sowmini Varadhan Subject: Re: [Patch net] rds: mark bound socket with SOCK_RCU_FREE Date: Mon, 10 Sep 2018 18:34:12 -0400 Message-ID: <20180910223412.GI4668@oracle.com> References: <20180910222422.19470-1-xiyou.wangcong@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, Santosh Shilimkar , rds-devel@oss.oracle.com To: Cong Wang Return-path: Received: from aserp2120.oracle.com ([141.146.126.78]:46214 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726740AbeIKDae (ORCPT ); Mon, 10 Sep 2018 23:30:34 -0400 Content-Disposition: inline In-Reply-To: <20180910222422.19470-1-xiyou.wangcong@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On (09/10/18 15:24), Cong Wang wrote: > > When a rds sock is bound, it is inserted into the bind_hash_table > which is protected by RCU. But when releasing rd sock, after it > is removed from this hash table, it is freed immediately without > respecting RCU grace period. This could cause some use-after-free > as reported by syzbot. > I have no objection to the change itself, but the syzbot failures are caused for a very simple reason: we need synchronize_net() in rds_release before we remove the rds_sock from the bind_hash_table. I already pointed this out in https://www.spinics.net/lists/netdev/msg475074.html I think the objection to synchronize_net() is that it can cause perf issues (I'm told that rds_release() has been known to be held up by other threads in rcu critical sections?) but I personally dont see any other alternative to this (other than going back to rwlock, instead of rcu) --Sowmini