From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755929AbbBEFzr (ORCPT ); Thu, 5 Feb 2015 00:55:47 -0500 Received: from mailout4.samsung.com ([203.254.224.34]:32818 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751080AbbBEFzp (ORCPT ); Thu, 5 Feb 2015 00:55:45 -0500 X-AuditID: cbfee68f-f791c6d000004834-42-54d305df9b74 Date: Thu, 05 Feb 2015 05:55:37 +0000 (GMT) From: Vishal Goel Subject: [PATCH 1/3] smack : Adds the synchronization mechanism in smack IPv6 hooks To: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, casey@schaufler-ca.com Cc: "himanshu.sh@samsung.com" Reply-to: vishal.goel@samsung.com MIME-version: 1.0 X-MTR: 20150205055123117@vishal.goel Msgkey: 20150205055123117@vishal.goel X-EPLocale: en_US.windows-1252 X-Priority: 3 X-EPWebmail-Msg-Type: personal X-EPWebmail-Reply-Demand: 0 X-EPApproval-Locale: X-EPHeader: ML X-MLAttribute: X-RootMTR: 20150205055123117@vishal.goel X-ParentMTR: X-ArchiveUser: X-CPGSPASS: N X-ConfirmMail: N,general Content-type: text/plain; charset=windows-1252 MIME-version: 1.0 Message-id: <495663379.668961423115736630.JavaMail.weblogic@epmlwas06a> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrCIsWRmVeSWpSXmKPExsWyRsSkWvc+6+UQg3/PhSwu75rD5sDo8XmT XABjFJdNSmpOZllqkb5dAlfGt9unGQvmqVc0TN/C3MA4Q62LkZNDSEBNounlLtYuRg4OCQET iU2dgiBhCQExiQv31rN1MXIBlSxllLjZfJYFImEi8a1hIjNEYg6jxKlFr5lAEiwCKhLt73cy g9hsAjoSl3tbwBqEBYIljrxYzAhiiwgUSTz7NBGsnlnAXGL5ggPsEEcoSixf+RqshldAUOLk zCdQy1Qkbp47AnYcr4CqxKWD8hBhOYklUy8zQdi8EjPan7LAxKd9XcMMYUtLnJ+1gRHmmcXf H0PF+SWO3d4B1SsgMfXMQagaTYk1p+5Cxfkk1ix8ywJTv+vUcmaYXfe3zIWqkZDY2vKEFeIV RYkp3Q/ZIWwDiSOL5rCie4VXwF3ixrcZ7KBwkxDo5ZC4++MS8wRGpVlI6mYhmTULySxkNQsY WVYxiqYWJBcUJ6UXGesVJ+YWl+al6yXn525iBCaG0/+e9e9gvHvA+hCjAAejEg+vxb5LIUKs iWXFlbmHGE2B0TSRWUo0OR+YfvJK4g2NzYwsTE1MjY3MLc2UxHkXSv0MFhJITyxJzU5NLUgt ii8qzUktPsTIxMEp1cDo8JtXauXbSX6cPT4vRI5aBHCeKuLg2sQStMmNd+bND0sdWzZUMmxf FWrxuKX3X4294vXQu2uY22p4Xs8S9z+ZMtU6RvHB+W23DzAoXTI8sFvCStPjV4L9wrVesQVX 1+/f7cD/MFvbK2na5uwL5nPdrh+qKl/frVfNYhvT2P7KNVqKRbB6UYASS3FGoqEWc1FxIgCH CEpUBwMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrGKsWRmVeSWpSXmKPExsVy+t/tXt2brJdDDO4f4LG4vGsOmwOjx+dN cgGMUWk2GamJKalFCql5yfkpmXnptkrewfHO8aZmBoa6hpYW5koKeYm5qbZKLj4Bum6ZOUBD lRTKEnNKgUIBicXFSvp2NkX5pSWpChn5xSW2StGG5kZ6RgZ6pkZ6hqaxVoYGBkamQDUJaRnf bp9mLJinXtEwfQtzA+MMtS5GTg4hATWJppe7WEFsCQETiW8NE5khbDGJC/fWs3UxcgHVzGGU OLXoNRNIgkVARaL9/U6wIjYBHYnLvS0sILawQLDEkReLGUFsEYEiiWefJoLVMwuYSyxfcIAd YpmixPKVr8FqeAUEJU7OfMICsUxF4ua5I0BHcADFVSUuHZSHCMtJLJl6mQnC5pWY0f6UBSY+ 7esaqDulJc7P2sAIc/Pi74+h4vwSx27vgOoVkJh65iBUjabEmlN3oeJ8EmsWvmWBqd91ajkz zK77W+ZC1UhIbG15wgrxiqLElO6H7BC2gcSRRXNY0b3CK+AucePbDPYJjLKzkKRmIWmfhaQd Wc0CRpZVjKKpBckFxUnpFYZ6xYm5xaV56XrJ+bmbGMFp6NnCHYxfzlsfYhTgYFTi4bXcdylE iDWxrLgy9xCjBAezkgiv71ugEG9KYmVValF+fFFpTmrxIUZTYKRNZJYSTc4Hpsi8knhDYxNz U2NTCwNDc3MzJXHe/+dyQ4QE0hNLUrNTUwtSi2D6mDg4pRoYl3xvsl9ZfX6byCnPqJPRPm3y +1f+VlW7c2KrW++jzxZ73a+frf//9E7h4TnuO27rMm53fWm9udZh6+ocCb+Jk0uXurS93PT+ eM23ux9Nzxg0rNQzkuBSjLCevutj5HLvzufci7rFtmg5KyTyrPUN/nVG02D63j+PS5hbeeRk HKZ8nytS+/jCKSWW4oxEQy3mouJEAIAmlylZAwAA DLP-Filter: Pass X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id t155tq9a022797 >>From 875727546f9ba0d3a98a906cff07fd710d72cadc Mon Sep 17 00:00:00 2001 From: Vishal Goel Date: Wed, 4 Feb 2015 03:02:55 +0530 Subject: This patch adds the rcu synchronization mechanism in SMACK IPv6 hooks while accessing smk_ipv6_port_list. Access to the port list is vulnerable to a race condition issue, it does not apply proper synchronization methods while working on critical section. It is possible that when one thread is reading the list, at the same time another thread is modifying the same port list, which can cause the major problems. To ensure proper synchronization between two threads, rcu mechanism has been applied while accessing and modifying the port list. RCU will also not affect the performance as in access control module there are more accesses than modification where RCU is most effective synchronization mechanism. Signed-off-by: Vishal Goel Signed-off-by: Himanshu Shukla --- security/smack/smack_lsm.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a688f7b..579a177 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -53,6 +53,7 @@ #define SMK_SENDING 2 #ifndef CONFIG_SECURITY_SMACK_NETFILTER +DEFINE_MUTEX(smack_ipv6_lock); LIST_HEAD(smk_ipv6_port_list); #endif static struct kmem_cache *smack_inode_cache; @@ -2240,17 +2241,20 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) * on the bound socket. Take the changes to the port * as well. */ - list_for_each_entry(spp, &smk_ipv6_port_list, list) { + rcu_read_lock(); + list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { if (sk != spp->smk_sock) continue; spp->smk_in = ssp->smk_in; spp->smk_out = ssp->smk_out; + rcu_read_unlock(); return; } /* * A NULL address is only used for updating existing * bound entries. If there isn't one, it's OK. */ + rcu_read_unlock(); return; } @@ -2266,16 +2270,18 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) * Look for an existing port list entry. * This is an indication that a port is getting reused. */ - list_for_each_entry(spp, &smk_ipv6_port_list, list) { + rcu_read_lock(); + list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { if (spp->smk_port != port) continue; spp->smk_port = port; spp->smk_sock = sk; spp->smk_in = ssp->smk_in; spp->smk_out = ssp->smk_out; + rcu_read_unlock(); return; } - + rcu_read_unlock(); /* * A new port entry is required. */ @@ -2288,7 +2294,9 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) spp->smk_in = ssp->smk_in; spp->smk_out = ssp->smk_out; - list_add(&spp->list, &smk_ipv6_port_list); + mutex_lock(&smack_ipv6_lock); + list_add_rcu(&spp->list, &smk_ipv6_port_list); + mutex_unlock(&smack_ipv6_lock); return; } @@ -2344,7 +2352,8 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, goto auditout; } - list_for_each_entry(spp, &smk_ipv6_port_list, list) { + rcu_read_lock(); + list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { if (spp->smk_port != port) continue; object = spp->smk_in; @@ -2352,6 +2361,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, ssp->smk_packet = spp->smk_out; break; } + rcu_read_unlock(); auditout: -- 1.8.3.2 {.n++%ݶw{.n+{G{ayʇڙ,jfhz_(階ݢj"mG?&~iOzv^m ?I