From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>
Subject: Re: [PATCH] netlink: enable skb header refcounting before sending first broadcast
Date: Mon, 13 Jul 2015 11:54:47 +0300 [thread overview]
Message-ID: <55A37CD7.9050104@yandex-team.ru> (raw)
In-Reply-To: <20150713072352.GA8485@gondor.apana.org.au>
On 13.07.2015 10:23, Herbert Xu wrote:
> On Fri, Jul 10, 2015 at 02:51:41PM +0300, Konstantin Khlebnikov wrote:
>> This fixes race between non-atomic updates of adjacent bit-fields:
>> skb->cloned could be lost because netlink broadcast clones skb after
>> sending it to the first listener who sets skb->peeked at the same skb.
>> As a result atomic refcounting of skb header stays disabled and
>> skb_release_data() frees it twice. Race leads to double-free in kmalloc-xxx.
>>
>> Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
>> Fixes: b19372273164 ("net: reorganize sk_buff for faster __copy_skb_header()")
>> ---
>> net/netlink/af_netlink.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
>> index dea925388a5b..921e0d8dfe3a 100644
>> --- a/net/netlink/af_netlink.c
>> +++ b/net/netlink/af_netlink.c
>> @@ -2028,6 +2028,12 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid
>> info.tx_filter = filter;
>> info.tx_data = filter_data;
>>
>> + /* Enable atomic refcounting in skb_release_data() before first send:
>> + * non-atomic set of that bit-field in __skb_clone() could race with
>> + * __skb_recv_datagram() which touches the same set of bit-fields.
>> + */
>> + skb->cloned = 1;
>> +
>> /* While we sleep in clone, do not allow to change socket list */
>>
>> netlink_lock_table();
>
> Your effort in finding this bug is wonderful. However I think
> the fix is a bit dirty.
>
> The real issue here is that the recv path no longer handles shared
> skbs. So either we need to fix the recv path to not touch skbs
> without cloning them, or we need to get rid of the use of shared
> skbs in netlink.
I don't think that recv path should care about shared skb -- skb can be
delivered into only one socket anyway.
Less dirty fix for that: do not send original skb.
That adds one extra clone but makes code much cleaner.
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1957,17 +1957,16 @@ static void do_one_broadcast(struct sock *sk,
}
sock_hold(sk);
- if (p->skb2 == NULL) {
- if (skb_shared(p->skb)) {
- p->skb2 = skb_clone(p->skb, p->allocation);
- } else {
- p->skb2 = skb_get(p->skb);
- /*
- * skb ownership may have been set when
- * delivered to a previous socket.
- */
- skb_orphan(p->skb2);
- }
+ if (p->skb2 == NULL || skb_shared(p->skb2)) {
+ kfree_skb(p->skb2);
+ p->skb2 = skb_clone(p->skb, p->allocation);
+ } else {
+ skb_get(p->skb2);
+ /*
+ * skb ownership may have been set when
+ * delivered to a previous socket.
+ */
+ skb_orphan(p->skb2);
}
if (p->skb2 == NULL) {
netlink_overrun(sk);
@@ -1997,7 +1996,6 @@ static void do_one_broadcast(struct sock *sk,
} else {
p->congested |= val;
p->delivered = 1;
- p->skb2 = NULL;
}
out:
sock_put(sk);
>
> In fact it looks I introduced the bug way back in
>
> commit a59322be07c964e916d15be3df473fb7ba20c41e
> Author: Herbert Xu <herbert@gondor.apana.org.au>
> Date: Wed Dec 5 01:53:40 2007 -0800
>
> [UDP]: Only increment counter on first peek/recv
>
> I will try to mend this error :)
>
> Cheers,
>
--
Konstantin
next prev parent reply other threads:[~2015-07-13 8:56 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-10 11:51 [PATCH] netlink: enable skb header refcounting before sending first broadcast Konstantin Khlebnikov
2015-07-10 13:49 ` Eric Dumazet
2015-07-10 14:08 ` Konstantin Khlebnikov
2015-07-13 7:23 ` Herbert Xu
2015-07-13 8:04 ` net: Clone skb before setting peeked flag Herbert Xu
2015-07-15 23:13 ` David Miller
2015-07-13 8:05 ` [PATCH] netlink: enable skb header refcounting before sending first broadcast Eric Dumazet
2015-07-13 8:10 ` Herbert Xu
2015-07-13 8:22 ` Eric Dumazet
2015-07-13 8:25 ` Herbert Xu
2015-07-13 8:28 ` Eric Dumazet
2015-07-13 8:31 ` Herbert Xu
2015-07-13 12:01 ` net: Fix skb csum races when peeking Herbert Xu
2015-07-13 14:25 ` Herbert Xu
2015-07-14 6:11 ` Eric Dumazet
2015-07-15 23:14 ` David Miller
2015-07-13 8:54 ` Konstantin Khlebnikov [this message]
2015-07-13 9:04 ` [PATCH] netlink: enable skb header refcounting before sending first broadcast Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55A37CD7.9050104@yandex-team.ru \
--to=khlebnikov@yandex-team.ru \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.