| Message ID | 1382533489-19248-1-git-send-email-nikolay@redhat.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Wed, Oct 23, 2013 at 03:04:49PM +0200, Nikolay Aleksandrov wrote: >We need to disable the netconsole (enabled = 0) before setting nt->np.dev >to NULL because otherwise we might still have users after the >netpoll_cleanup() since nt->enabled is set afterwards and we can >have a message which will result in a NULL pointer dereference. >It is very easy to hit dereferences all over the netpoll_send_udp function >by running the following two loops in parallel: >while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done; >while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done; >(the second loop is to generate messages, it can be done by anything) > >We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock >since it's required in the write_msg() function. > >Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> >--- >Taking the spinlock seems like the cleanest way to insure there's noone >running in parallel, but I'm open to suggestions as I'm not satisfied with >the looks of this. I'll prepare a net-next patchset for netconsole soon to >clean it up properly, all of these can be easily simplified. First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought "WTF?", however indeed it will stop us racing with write_msg(). FWIW... Reviewed-by: Veacelsav Falico <vfalico@redhat.com> > > drivers/net/netconsole.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c >index adeee61..1505dcb 100644 >--- a/drivers/net/netconsole.c >+++ b/drivers/net/netconsole.c >@@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt, > const char *buf, > size_t count) > { >+ unsigned long flags; > int enabled; > int err; > >@@ -342,6 +343,13 @@ static ssize_t store_enabled(struct netconsole_target *nt, > printk(KERN_INFO "netconsole: network logging started\n"); > > } else { /* 0 */ >+ /* We need to disable the netconsole before cleaning it up >+ * otherwise we might end up in write_msg() with >+ * nt->np.dev == NULL and nt->enabled == 1 >+ */ >+ spin_lock_irqsave(&target_list_lock, flags); >+ nt->enabled = 0; >+ spin_unlock_irqrestore(&target_list_lock, flags); > netpoll_cleanup(&nt->np); > } > >-- >1.8.1.4 > >-- >To unsubscribe from this list: send the line "unsubscribe netdev" in >the body of a message to majordomo@vger.kernel.org >More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
> >Taking the spinlock seems like the cleanest way to insure there's noone > >running in parallel, but I'm open to suggestions as I'm not satisfied with > >the looks of this. I'll prepare a net-next patchset for netconsole soon to > >clean it up properly, all of these can be easily simplified. > > First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought > "WTF?", however indeed it will stop us racing with write_msg(). Ditto - might be worth saying: /* Acquire lock to wait for any write_msg() to complete. */ David -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: "David Laight" <David.Laight@ACULAB.COM> Date: Thu, 24 Oct 2013 11:39:02 +0100 >> >Taking the spinlock seems like the cleanest way to insure there's noone >> >running in parallel, but I'm open to suggestions as I'm not satisfied with >> >the looks of this. I'll prepare a net-next patchset for netconsole soon to >> >clean it up properly, all of these can be easily simplified. >> >> First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought >> "WTF?", however indeed it will stop us racing with write_msg(). > > Ditto - might be worth saying: > /* Acquire lock to wait for any write_msg() to complete. */ Something this subtle definitely requires a comment. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 10/24/2013 07:56 PM, David Miller wrote: > From: "David Laight" <David.Laight@ACULAB.COM> > Date: Thu, 24 Oct 2013 11:39:02 +0100 > >>>> Taking the spinlock seems like the cleanest way to insure there's noone >>>> running in parallel, but I'm open to suggestions as I'm not satisfied with >>>> the looks of this. I'll prepare a net-next patchset for netconsole soon to >>>> clean it up properly, all of these can be easily simplified. >>> >>> First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought >>> "WTF?", however indeed it will stop us racing with write_msg(). >> >> Ditto - might be worth saying: >> /* Acquire lock to wait for any write_msg() to complete. */ > > Something this subtle definitely requires a comment. > Okay, thank you all for the reviews. I will re-submit a v2 with the comment edited. Nik -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Nikolay Aleksandrov <nikolay@redhat.com> : > On 10/24/2013 07:56 PM, David Miller wrote: > > From: "David Laight" <David.Laight@ACULAB.COM> [...] > >> Ditto - might be worth saying: > >> /* Acquire lock to wait for any write_msg() to complete. */ > > > > Something this subtle definitely requires a comment. > > > Okay, thank you all for the reviews. I will re-submit a v2 with > the comment edited. "edited" as in "removed" because: 1. an irq disabling spinlock loudly states what the intent is ("hey, this netconsole stuff could be concurrently used in irq or softirq context"). 2. the target_list_lock spinlock itself tells where to look for: drivers/net/netconsole.c [...] /* This needs to be a spinlock because write_msg() cannot sleep */ static DEFINE_SPINLOCK(target_list_lock);
On 10/24/2013 10:59 PM, Francois Romieu wrote: > Nikolay Aleksandrov <nikolay@redhat.com> : >> On 10/24/2013 07:56 PM, David Miller wrote: >>> From: "David Laight" <David.Laight@ACULAB.COM> > [...] >>>> Ditto - might be worth saying: >>>> /* Acquire lock to wait for any write_msg() to complete. */ >>> >>> Something this subtle definitely requires a comment. >>> >> Okay, thank you all for the reviews. I will re-submit a v2 with >> the comment edited. > > "edited" as in "removed" because: > 1. an irq disabling spinlock loudly states what the intent is ("hey, this > netconsole stuff could be concurrently used in irq or softirq context"). > 2. the target_list_lock spinlock itself tells where to look for: > > drivers/net/netconsole.c > [...] > /* This needs to be a spinlock because write_msg() cannot sleep */ > static DEFINE_SPINLOCK(target_list_lock); > I thought so too. Although I also mentioned the problem and that it involves write_msg in the current comment: + /* We need to disable the netconsole before cleaning it up + * otherwise we might end up in write_msg() with + * nt->np.dev == NULL and nt->enabled == 1 + */ I thought this implies that the spinlock protects us against running with write_msg(). It's fine by me either way (with or w/o the addition to the comment). It's up to you Dave, do you still want it explicitly there ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Nikolay Aleksandrov <nikolay@redhat.com> : [...] > I thought this implies that the spinlock protects us against running with > write_msg(). > It's fine by me either way (with or w/o the addition to the comment). It's > up to you Dave, do you still want it explicitly there ? There was some facetiousness in David's comment.
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index adeee61..1505dcb 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt, const char *buf, size_t count) { + unsigned long flags; int enabled; int err; @@ -342,6 +343,13 @@ static ssize_t store_enabled(struct netconsole_target *nt, printk(KERN_INFO "netconsole: network logging started\n"); } else { /* 0 */ + /* We need to disable the netconsole before cleaning it up + * otherwise we might end up in write_msg() with + * nt->np.dev == NULL and nt->enabled == 1 + */ + spin_lock_irqsave(&target_list_lock, flags); + nt->enabled = 0; + spin_unlock_irqrestore(&target_list_lock, flags); netpoll_cleanup(&nt->np); }
We need to disable the netconsole (enabled = 0) before setting nt->np.dev to NULL because otherwise we might still have users after the netpoll_cleanup() since nt->enabled is set afterwards and we can have a message which will result in a NULL pointer dereference. It is very easy to hit dereferences all over the netpoll_send_udp function by running the following two loops in parallel: while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done; while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done; (the second loop is to generate messages, it can be done by anything) We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock since it's required in the write_msg() function. Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> --- Taking the spinlock seems like the cleanest way to insure there's noone running in parallel, but I'm open to suggestions as I'm not satisfied with the looks of this. I'll prepare a net-next patchset for netconsole soon to clean it up properly, all of these can be easily simplified. drivers/net/netconsole.c | 8 ++++++++ 1 file changed, 8 insertions(+)