From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [Patch net v2] rds: fix two RCU related problems Date: Wed, 12 Sep 2018 00:10:02 -0700 (PDT) Message-ID: <20180912.001002.2039573031999197896.davem@davemloft.net> References: <20180911012726.5353-1-xiyou.wangcong@gmail.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, sowmini.varadhan@oracle.com, santosh.shilimkar@oracle.com, rds-devel@oss.oracle.com To: xiyou.wangcong@gmail.com Return-path: Received: from shards.monkeyblade.net ([23.128.96.9]:57794 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725966AbeILMNM (ORCPT ); Wed, 12 Sep 2018 08:13:12 -0400 In-Reply-To: <20180911012726.5353-1-xiyou.wangcong@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Cong Wang Date: Mon, 10 Sep 2018 18:27:26 -0700 > When a rds sock is bound, it is inserted into the bind_hash_table > which is protected by RCU. But when releasing rds sock, after it > is removed from this hash table, it is freed immediately without > respecting RCU grace period. This could cause some use-after-free > as reported by syzbot. > > Mark the rds sock with SOCK_RCU_FREE before inserting it into the > bind_hash_table, so that it would be always freed after a RCU grace > period. > > The other problem is in rds_find_bound(), the rds sock could be > freed in between rhashtable_lookup_fast() and rds_sock_addref(), > so we need to extend RCU read lock protection in rds_find_bound() > to close this race condition. > > Reported-and-tested-by: syzbot+8967084bcac563795dc6@syzkaller.appspotmail.com > Reported-by: syzbot+93a5839deb355537440f@syzkaller.appspotmail.com > Cc: Sowmini Varadhan > Cc: Santosh Shilimkar > Cc: rds-devel@oss.oracle.com > Signed-off-by: Cong Wang Applied and queued up for -stable, thanks.