The freeing and re-allocation of algorithm are protected by cpool_mutex,
so it doesn't fix an actual use-after-free, but avoids a deserved
refcount_warn_saturate() warning.
A trivial fix for the racy behavior.
Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
Suggested-by: Eric Dumazet <[email protected]>
Signed-off-by: Dmitry Safonov <[email protected]>
---
net/ipv4/tcp_sigpool.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_sigpool.c b/net/ipv4/tcp_sigpool.c
index 55b310a722c7..8512cb09ebc0 100644
--- a/net/ipv4/tcp_sigpool.c
+++ b/net/ipv4/tcp_sigpool.c
@@ -162,9 +162,8 @@ int tcp_sigpool_alloc_ahash(const char *alg, size_t scratch_size)
if (strcmp(cpool[i].alg, alg))
continue;
- if (kref_read(&cpool[i].kref) > 0)
- kref_get(&cpool[i].kref);
- else
+ /* pairs with tcp_sigpool_release() */
+ if (!kref_get_unless_zero(&cpool[i].kref))
kref_init(&cpool[i].kref);
ret = i;
goto out;
---
base-commit: 1a44b0073b9235521280e19d963b6dfef7888f18
change-id: 20231222-tcp-ao-kref_get_unless_zero-fe7105781ba4
Best regards,
--
Dmitry Safonov <[email protected]>
On Fri, Dec 22, 2023 at 01:13:59AM +0000, Dmitry Safonov wrote:
> The freeing and re-allocation of algorithm are protected by cpool_mutex,
> so it doesn't fix an actual use-after-free, but avoids a deserved
> refcount_warn_saturate() warning.
>
> A trivial fix for the racy behavior.
>
> Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
> Suggested-by: Eric Dumazet <[email protected]>
> Signed-off-by: Dmitry Safonov <[email protected]>
> ---
> net/ipv4/tcp_sigpool.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/tcp_sigpool.c b/net/ipv4/tcp_sigpool.c
> index 55b310a722c7..8512cb09ebc0 100644
> --- a/net/ipv4/tcp_sigpool.c
> +++ b/net/ipv4/tcp_sigpool.c
> @@ -162,9 +162,8 @@ int tcp_sigpool_alloc_ahash(const char *alg, size_t scratch_size)
> if (strcmp(cpool[i].alg, alg))
> continue;
>
> - if (kref_read(&cpool[i].kref) > 0)
> - kref_get(&cpool[i].kref);
> - else
> + /* pairs with tcp_sigpool_release() */
> + if (!kref_get_unless_zero(&cpool[i].kref))
> kref_init(&cpool[i].kref);
> ret = i;
> goto out;
>
> ---
> base-commit: 1a44b0073b9235521280e19d963b6dfef7888f18
> change-id: 20231222-tcp-ao-kref_get_unless_zero-fe7105781ba4
>
No observable regressions when booting the kernel with this patch applied.
Tested-by: Bagas Sanjaya <[email protected]>
--
An old man doll... just what I always wanted! - Clara
On Fri, Dec 22, 2023 at 2:14 AM Dmitry Safonov <[email protected]> wrote:
>
> The freeing and re-allocation of algorithm are protected by cpool_mutex,
> so it doesn't fix an actual use-after-free, but avoids a deserved
> refcount_warn_saturate() warning.
>
> A trivial fix for the racy behavior.
>
> Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
> Suggested-by: Eric Dumazet <[email protected]>
> Signed-off-by: Dmitry Safonov <[email protected]>
Reported-by: syzbot <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Hello:
This patch was applied to netdev/net.git (main)
by David S. Miller <[email protected]>:
On Fri, 22 Dec 2023 01:13:59 +0000 you wrote:
> The freeing and re-allocation of algorithm are protected by cpool_mutex,
> so it doesn't fix an actual use-after-free, but avoids a deserved
> refcount_warn_saturate() warning.
>
> A trivial fix for the racy behavior.
>
> Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
> Suggested-by: Eric Dumazet <[email protected]>
> Signed-off-by: Dmitry Safonov <[email protected]>
>
> [...]
Here is the summary with links:
- net/tcp_sigpool: Use kref_get_unless_zero()
https://git.kernel.org/netdev/net/c/b901a4e27694
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html