[rds-devel] [Patch net v2] rds: fix two RCU related problems

[Santosh Shilimkar]

On 9/10/2018 6:27 PM, Cong Wang wrote:
> When a rds sock is bound, it is inserted into the bind_hash_table
> which is protected by RCU. But when releasing rds sock, after it
> is removed from this hash table, it is freed immediately without
> respecting RCU grace period. This could cause some use-after-free
> as reported by syzbot.
> 
> Mark the rds sock with SOCK_RCU_FREE before inserting it into the
> bind_hash_table, so that it would be always freed after a RCU grace
> period.
> 
> The other problem is in rds_find_bound(), the rds sock could be
> freed in between rhashtable_lookup_fast() and rds_sock_addref(),
> so we need to extend RCU read lock protection in rds_find_bound()
> to close this race condition.
> 
> Reported-and-tested-by: syzbot+8967084bcac563795dc6 at syzkaller.appspotmail.com
> Reported-by: syzbot+93a5839deb355537440f at syzkaller.appspotmail.com
> Cc: Sowmini Varadhan <sowmini.varadhan at oracle.com>
> Cc: Santosh Shilimkar <santosh.shilimkar at oracle.com>
> Cc: rds-devel at oss.oracle.com
> Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>
> ---
Thank you !!
Acked-by: Santosh Shilimkar <santosh.shilimkar at oarcle.com>