[{"id":1764496,"web_url":"http://patchwork.ozlabs.org/comment/1764496/","msgid":"<20170906.212425.1399303829278739542.davem@davemloft.net>","list_archive_url":null,"date":"2017-09-07T04:24:25","subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","submitter":{"id":15,"url":"http://patchwork.ozlabs.org/api/people/15/","name":"David Miller","email":"davem@davemloft.net"},"content":"From: Xin Long \nDate: Wed, 6 Sep 2017 11:53:29 +0800\n\n> Now there is no lock protecting nlk ngroups/groups' accessing in\n> netlink bind and getname. It's safe from nlk groups' setting in\n> netlink_release, but not from netlink_realloc_groups called by\n> netlink_setsockopt.\n> \n> netlink_lock_table is needed in both netlink bind and getname when\n> accessing nlk groups.\n> \n> Acked-by: Florian Westphal \n> Signed-off-by: Xin Long \n\nApplied.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xnnR12Yz6z9sCZ\n\tfor ;\n\tThu, 7 Sep 2017 14:24:29 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1752808AbdIGEY1 (ORCPT );\n\tThu, 7 Sep 2017 00:24:27 -0400","from shards.monkeyblade.net ([184.105.139.130]:46654 \"EHLO\n\tshards.monkeyblade.net\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1752525AbdIGEY0 (ORCPT\n\t); Thu, 7 Sep 2017 00:24:26 -0400","from localhost (74-93-104-98-Washington.hfc.comcastbusiness.net\n\t[74.93.104.98]) (using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(Client did not present a certificate)\n\t(Authenticated sender: davem-davemloft)\n\tby shards.monkeyblade.net (Postfix) with ESMTPSA id 0FAD11019A4F4;\n\tWed, 6 Sep 2017 21:24:25 -0700 (PDT)"],"Date":"Wed, 06 Sep 2017 21:24:25 -0700 (PDT)","Message-Id":"<20170906.212425.1399303829278739542.davem@davemloft.net>","To":"lucien.xin@gmail.com","Cc":"netdev@vger.kernel.org, fw@strlen.de","Subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","From":"David Miller ","In-Reply-To":"","References":"","X-Mailer":"Mew version 6.7 on Emacs 25.2 / Mule 6.0 (HANACHIRUSATO)","Mime-Version":"1.0","Content-Type":"Text/Plain; charset=us-ascii","Content-Transfer-Encoding":"7bit","X-Greylist":"Sender succeeded SMTP AUTH, not delayed by\n\tmilter-greylist-4.5.12 (shards.monkeyblade.net\n\t[149.20.54.216]); Wed, 06 Sep 2017 21:24:26 -0700 (PDT)","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}},{"id":1765599,"web_url":"http://patchwork.ozlabs.org/comment/1765599/","msgid":"","list_archive_url":null,"date":"2017-09-08T19:35:51","subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","submitter":{"id":211,"url":"http://patchwork.ozlabs.org/api/people/211/","name":"Cong Wang","email":"xiyou.wangcong@gmail.com"},"content":"On Tue, Sep 5, 2017 at 8:53 PM, Xin Long wrote:\n> Now there is no lock protecting nlk ngroups/groups' accessing in\n> netlink bind and getname. It's safe from nlk groups' setting in\n> netlink_release, but not from netlink_realloc_groups called by\n> netlink_setsockopt.\n>\n> netlink_lock_table is needed in both netlink bind and getname when\n> accessing nlk groups.\n\nThis looks very odd.\n\nnetlink_lock_table() should be protecting nl_table, why\nit also protects nlk->groups?? For me it looks like you\nneed lock_sock() instead.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"Pu/N1/AS\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xpncc0MVvz9sRV\n\tfor ;\n\tSat, 9 Sep 2017 05:36:16 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1756937AbdIHTgN (ORCPT );\n\tFri, 8 Sep 2017 15:36:13 -0400","from mail-pg0-f44.google.com ([74.125.83.44]:34638 \"EHLO\n\tmail-pg0-f44.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1756671AbdIHTgM (ORCPT\n\t); Fri, 8 Sep 2017 15:36:12 -0400","by mail-pg0-f44.google.com with SMTP id q68so6354772pgq.1\n\tfor ; Fri, 08 Sep 2017 12:36:12 -0700 (PDT)","by 10.100.140.134 with HTTP; Fri, 8 Sep 2017 12:35:51 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=mime-version:in-reply-to:references:from:date:message-id:subject:to\n\t:cc; bh=j47apL52WMQlcvsev65nXm0wYrgEf4i5vXwBRsFcyek=;\n\tb=Pu/N1/AS+7+nSsn5PCSgVqZ8oWdKMWc3u46b4A0asRkXMC9O6LnuH0OfqNJJvcM2j+\n\tlvZ+Ui19lcjIb8GBLbxEcr/KpLdzQz3WlH9lWjv/YaDq0HmTA64e6DFq6/avdBtI3f7Y\n\tpx8Qis21MIsgyDMrVBVclKQQi19kd8C5jGqesXu5XUJd/Q52r4QKu827qTxuhDwePt47\n\tww4vSzsheeXlKNyO3VWzyv0UP0NteQemNgGKawlk1sEx3D9wz2rUCOkHPgIB/sw01WDE\n\tgr40NaPgAj1UeCKJrgjT0l8Fy7TGDblUAGQtQPFhHylTJvFwp7u3AU2SeUBarzMxsW5u\n\tLcKQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:in-reply-to:references:from:date\n\t:message-id:subject:to:cc;\n\tbh=j47apL52WMQlcvsev65nXm0wYrgEf4i5vXwBRsFcyek=;\n\tb=HonfsSkYZhnVEvx4cNwGssOB1TPhKIjLely64IfJa59jx94FWui/RfRSPh6oOzYoZN\n\t4+U+AU8+4d9GNVZoQaqiDko0b/TxCwagDq77/cQTjmD9h8GtGRFSksBzdbzqQgj4le2J\n\tKs2swuBRH2sx93jJb2NVXLm8FFrVSvHnTMa+FL7qUfqausNQVhz19JiSBNDhrvTRV7zJ\n\tpN8SqIrGhR4MYxLqpqw4NwnPfYR3Op0t3ko3bYuthv+eJa1Z/koZbaQ+WZkBPb30Iyew\n\tCktJEcyvV9WBRf0+QdbrJ9HQ4TNe/2ZoMedtqspqnqHByl2pQ8aFhE+em2xvvWltuZCw\n\twLYw==","X-Gm-Message-State":"AHPjjUj7KoghDiZzkqAFF6PrkGs/KX8d6Xh8EWND+UalP5eENLUYuct8\n\tY6jUMuxjY6051LaekjmZpcoIXenQ2oNO3os=","X-Google-Smtp-Source":"ADKCNb4R0rBkkenMHTkzrrQp5JkuF5PGQriP6JOavdGVu1KZTcGI6qzS46gRr/sv/SSDw/ewq6vZoErbehNJnK67ShM=","X-Received":"by 10.99.163.67 with SMTP id v3mr4111228pgn.206.1504899372172;\n\tFri, 08 Sep 2017 12:36:12 -0700 (PDT)","MIME-Version":"1.0","In-Reply-To":"","References":"","From":"Cong Wang ","Date":"Fri, 8 Sep 2017 12:35:51 -0700","Message-ID":"","Subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","To":"Xin Long ","Cc":"network dev , David Miller ,\n\tFlorian Westphal ","Content-Type":"text/plain; charset=\"UTF-8\"","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}},{"id":1765937,"web_url":"http://patchwork.ozlabs.org/comment/1765937/","msgid":"","list_archive_url":null,"date":"2017-09-10T11:45:52","subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","submitter":{"id":61073,"url":"http://patchwork.ozlabs.org/api/people/61073/","name":"Xin Long","email":"lucien.xin@gmail.com"},"content":"On Sat, Sep 9, 2017 at 7:35 AM, Cong Wang wrote:\n> On Tue, Sep 5, 2017 at 8:53 PM, Xin Long wrote:\n>> Now there is no lock protecting nlk ngroups/groups' accessing in\n>> netlink bind and getname. It's safe from nlk groups' setting in\n>> netlink_release, but not from netlink_realloc_groups called by\n>> netlink_setsockopt.\n>>\n>> netlink_lock_table is needed in both netlink bind and getname when\n>> accessing nlk groups.\n>\n> This looks very odd.\n>\n> netlink_lock_table() should be protecting nl_table, why\n> it also protects nlk->groups?? For me it looks like you\n> need lock_sock() instead.\nI believe netlink_lock_table might be only used to protect nl_table\nat the beginning and surely lock_sock is better here. Thanks.\n\nBut can you explain why netlink_lock_table() was also used in\nnetlink_getsockopt NETLINK_LIST_MEMBERSHIPS ? or it\nwas just a mistake ?","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"slZV0frG\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xqq515kpjz9sNV\n\tfor ;\n\tSun, 10 Sep 2017 21:45:57 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751451AbdIJLpz (ORCPT );\n\tSun, 10 Sep 2017 07:45:55 -0400","from mail-qk0-f173.google.com ([209.85.220.173]:36448 \"EHLO\n\tmail-qk0-f173.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751246AbdIJLpy (ORCPT\n\t); Sun, 10 Sep 2017 07:45:54 -0400","by mail-qk0-f173.google.com with SMTP id z143so14102955qkb.3\n\tfor ; Sun, 10 Sep 2017 04:45:53 -0700 (PDT)","by 10.140.108.100 with HTTP; Sun, 10 Sep 2017 04:45:52 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=mime-version:in-reply-to:references:from:date:message-id:subject:to\n\t:cc; bh=J/EwBKVvXcGBwHkmKKFkzd6OohGxShhoNC5gEjCoQ2Y=;\n\tb=slZV0frGmc88rUtBVjCMMQmGgLYyybLeK6ZAmcKAFxDkg+QahR3YZU+GPP2tO3a5yO\n\t2W/Am94S2unbM9M7x4/UZo3/YY04hnD8fXOAUfMtULn4YDXMcw8VIkZC8+WtDrNiKiBL\n\tvi+/IVIF73rztAEdO+ebqC742PAcNGoreWBsNEW7dyyGNVILKHNPK+9pPqXmZFKo3a0z\n\tz0w19+EbBhVAEr8YHvhSyLNsL+f8QM+84RPq5Cm2zwYB21HXjdjwCrsQxx4NtAeeJ3uL\n\t4NJ/zglkIJmkZ9knWBd0E49cX6iXygrxMeWLxngRrniTsJ4M/MBGKcJ2O9CyX5aLaGVj\n\tBd0w==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:in-reply-to:references:from:date\n\t:message-id:subject:to:cc;\n\tbh=J/EwBKVvXcGBwHkmKKFkzd6OohGxShhoNC5gEjCoQ2Y=;\n\tb=Ztl54IAIPzkWTf/wGW7w1MvV9KNRQXoiKA4y96L1ma8ZrtmsD54LoWARIhOLC6/18S\n\tL+d48mRZPbi+UgRd5702hDEaIwLhcj2+OwJbfbXKsM3579X30U21O63LdubzwWRDeCxn\n\tCpVyr6g/lqVlGhYg19/f0y003ycatMCKHYDlP56zQ6tjWgk2pfXvZSfRqHMa/hANEknV\n\tKeru2dECKh1clOt0JIeP2BjRaBZsW1tnLa2tuHNJ1vwkCQ5PwdHe46HkxPvcRC4SdvsH\n\t1p/bFBOyZkskHQmlg6fsxhAcHRRENBGPF1R00LOCg0v4U/QEfKz7qs6MQzyHesvMF/NL\n\tGMpQ==","X-Gm-Message-State":"AHPjjUihHYRnXYeo1yTQX0p9I6C9uQgagDGdDmLt+ZHF0p34UGhp1EmY\n\t6oAPvl+7K4aijqdadQgEL5DdJ4BP9A==","X-Google-Smtp-Source":"AOwi7QA1EGkJ4JsbdkYV4Ng2v+1BpinUJOu4hoNBsRgPkUPDQHGgrWzKxTd3rnxNfEhPdYbTbkKDdt8QQSnoyDh/vH0=","X-Received":"by 10.55.129.131 with SMTP id\n\tc125mr10804955qkd.285.1505043953511; \n\tSun, 10 Sep 2017 04:45:53 -0700 (PDT)","MIME-Version":"1.0","In-Reply-To":"","References":"\n\t","From":"Xin Long ","Date":"Sun, 10 Sep 2017 23:45:52 +1200","Message-ID":"","Subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","To":"Cong Wang ","Cc":"network dev , David Miller ,\n\tFlorian Westphal ","Content-Type":"text/plain; charset=\"UTF-8\"","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}},{"id":1766417,"web_url":"http://patchwork.ozlabs.org/comment/1766417/","msgid":"","list_archive_url":null,"date":"2017-09-11T17:35:04","subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","submitter":{"id":211,"url":"http://patchwork.ozlabs.org/api/people/211/","name":"Cong Wang","email":"xiyou.wangcong@gmail.com"},"content":"On Sun, Sep 10, 2017 at 4:45 AM, Xin Long wrote:\n> On Sat, Sep 9, 2017 at 7:35 AM, Cong Wang wrote:\n>> On Tue, Sep 5, 2017 at 8:53 PM, Xin Long wrote:\n>>> Now there is no lock protecting nlk ngroups/groups' accessing in\n>>> netlink bind and getname. It's safe from nlk groups' setting in\n>>> netlink_release, but not from netlink_realloc_groups called by\n>>> netlink_setsockopt.\n>>>\n>>> netlink_lock_table is needed in both netlink bind and getname when\n>>> accessing nlk groups.\n>>\n>> This looks very odd.\n>>\n>> netlink_lock_table() should be protecting nl_table, why\n>> it also protects nlk->groups?? For me it looks like you\n>> need lock_sock() instead.\n> I believe netlink_lock_table might be only used to protect nl_table\n> at the beginning and surely lock_sock is better here. Thanks.\n>\n> But can you explain why netlink_lock_table() was also used in\n> netlink_getsockopt NETLINK_LIST_MEMBERSHIPS ? or it\n> was just a mistake ?\n\nNo, it is fine but not necessary, because netlink_realloc_groups()\ndoesn't change nl_table, it only changes nlk->groups. So we\ndon't have take the global write lock, the lock sock makes more\nsense here, same for your bind() and getname() case.","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"righiP0g\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xrZnv5PzSz9s83\n\tfor ;\n\tTue, 12 Sep 2017 03:35:31 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1752444AbdIKRf2 (ORCPT );\n\tMon, 11 Sep 2017 13:35:28 -0400","from mail-pg0-f48.google.com ([74.125.83.48]:38290 \"EHLO\n\tmail-pg0-f48.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1752436AbdIKRf0 (ORCPT\n\t); Mon, 11 Sep 2017 13:35:26 -0400","by mail-pg0-f48.google.com with SMTP id v66so16446193pgb.5\n\tfor ; Mon, 11 Sep 2017 10:35:25 -0700 (PDT)","by 10.100.160.131 with HTTP; Mon, 11 Sep 2017 10:35:04 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=mime-version:in-reply-to:references:from:date:message-id:subject:to\n\t:cc; bh=OveyyK24GKrjOWxHf1MT5MJvZcTe8kMqHf/1uXgFfKI=;\n\tb=righiP0gCvYbLfG8KlWyc34obY9LsSeHg7LjvddoO27x5vyQg0zW6FAkh4FrcvkEJA\n\t9Pt/orIVbbEx4WFsGwPgiHnE7GvrYTItcCUgp2RdS9Kb6xuVAgXWxSHsV7Xvh5Ebo3kV\n\tBIcYCfK2h8oHYS1ELTeVbZvg7yqmFz/wgdQBTwNLfMeLoExoLgP338uwgivZ0O9vdJM9\n\tSkU0U3mKGIOwPjVYQ2JrbQNzwWeRBtvPK3bsTlMYAtBMrKze1bGwqpPD/2e6SGPrwsFe\n\tFsYN7ksCrpvmqS/LTGedDHk8PI9W8cvAznR46uIe9xFaPEhFksa5wNJCn9y3oWXU9woM\n\tXKHA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:mime-version:in-reply-to:references:from:date\n\t:message-id:subject:to:cc;\n\tbh=OveyyK24GKrjOWxHf1MT5MJvZcTe8kMqHf/1uXgFfKI=;\n\tb=WomlmLE0VUut+zsRnKoMquBLTuWzsPWj50XWly6K9lUhHiEzn71jdo/P5WtEKIFWPF\n\tduMwbLf/IuzPWy/T6LLCC0/tVRnuNl9nih5cU+tCsFmR2buhhEcUq2SKMgiu93TDBFYE\n\tjaFNtk6VtjyzTh4Pc5bGLZCmspporkBAgiryxN4106Y4S+Hc+fqqcrj78P3o0vlq6b6c\n\tgjSDyl59DgCypIs6l8bAF2BjV71zUpncTekIPDSeok+WmGK4lp/R7GXEpReuZgVRmbCY\n\tG9pihKTzHgZp8KNqAe5eBUUyBrdRC2uZnEA+oSsfk83C0JQuj5KMSTiGjBI0VE4QLHmw\n\tVqeA==","X-Gm-Message-State":"AHPjjUgROAvkVdUOcCt8SA4It/3LsmdqU5SkouV+WKMdDYEhfzhRUcxJ\n\tAbMDSvdz842HWuwbUnr0IaSW/2bXZw==","X-Google-Smtp-Source":"AOwi7QAIaeUesV/qrl/tZaMiJWbOPrl8YKgQWJG0nLZHzwdqGKRuxijN81nMdWu0sZSACGPJwqBNphO2Umy5a/cpTig=","X-Received":"by 10.84.176.100 with SMTP id u91mr94657plb.10.1505151325455;\n\tMon, 11 Sep 2017 10:35:25 -0700 (PDT)","MIME-Version":"1.0","In-Reply-To":"","References":"\n\t\n\t","From":"Cong Wang ","Date":"Mon, 11 Sep 2017 10:35:04 -0700","Message-ID":"","Subject":"Re: [PATCH net] netlink: access nlk groups safely in netlink bind\n\tand getname","To":"Xin Long ","Cc":"network dev , David Miller ,\n\tFlorian Westphal , David Herrmann ","Content-Type":"text/plain; charset=\"UTF-8\"","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}}]