lkml.org 
[lkml]   [2018]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH net V2] tun: fix use after free for ptr_ring
From
Date


On 2018年05月12日 01:39, Cong Wang wrote:
> On Thu, May 10, 2018 at 7:49 PM, Jason Wang <jasowang@redhat.com> wrote:
>> static void __tun_detach(struct tun_file *tfile, bool clean)
>> {
>> struct tun_file *ntfile;
>> @@ -736,7 +727,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>> tun->dev->reg_state == NETREG_REGISTERED)
>> unregister_netdevice(tun->dev);
>> }
>> - tun_cleanup_tx_ring(tfile);
>> + if (tun)
>> + xdp_rxq_info_unreg(&tfile->xdp_rxq);
>> sock_put(&tfile->sk);
>> }
>> }
>> @@ -783,14 +775,14 @@ static void tun_detach_all(struct net_device *dev)
>> tun_napi_del(tun, tfile);
>> /* Drop read queue */
>> tun_queue_purge(tfile);
>> + xdp_rxq_info_unreg(&tfile->xdp_rxq);
>> sock_put(&tfile->sk);
>> - tun_cleanup_tx_ring(tfile);
>> }
>> list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
>> tun_enable_queue(tfile);
>> tun_queue_purge(tfile);
>> + xdp_rxq_info_unreg(&tfile->xdp_rxq);
>> sock_put(&tfile->sk);
>> - tun_cleanup_tx_ring(tfile);
> Are you sure t is safe?
>
> xdp_rxq_info_unreg() can't be called more than once either,
> please make sure the warning that commit c13da21cdb80
> ("tun: avoid calling xdp_rxq_info_unreg() twice") fixed will not
> show up again.

I think it's safe. xdp_rxq_info_unreg() will be called when socket were
detached from netdevice, and there's only two possible paths: release()
and uninit(). We've synced them through rtnl lock.

Thanks

\
 
 \ /
  Last update: 2018-05-14 03:54    [W:0.204 / U:6.516 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site