diff mbox series

net: Protect iterations over net::fib_notifier_ops in fib_seq_sum()

Message ID 151066746546.14355.8649773749613206923.stgit@localhost.localdomain
State Accepted, archived
Delegated to: David Miller
Headers show
Series net: Protect iterations over net::fib_notifier_ops in fib_seq_sum() | expand

Commit Message

Kirill Tkhai Nov. 14, 2017, 1:51 p.m. UTC 
There is at least unlocked deletion of net->ipv4.fib_notifier_ops
from net::fib_notifier_ops:

ip_fib_net_exit()
  rtnl_unlock()
  fib4_notifier_exit()
    fib_notifier_ops_unregister(net->ipv4.notifier_ops)
      list_del_rcu(&ops->list)

So fib_seq_sum() can't use rtnl_lock() only for protection.

The possible solution could be to use rtnl_lock()
in fib_notifier_ops_unregister(), but this adds
a possible delay during net namespace creation,
so we better use rcu_read_lock() till someone
really needs the mutex (if that happens).

Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
---
 net/core/fib_notifier.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

David Miller Nov. 15, 2017, 5:12 a.m. UTC | #1 
From: Kirill Tkhai <ktkhai@virtuozzo.com>
Date: Tue, 14 Nov 2017 16:51:56 +0300

> There is at least unlocked deletion of net->ipv4.fib_notifier_ops
> from net::fib_notifier_ops:
> 
> ip_fib_net_exit()
>   rtnl_unlock()
>   fib4_notifier_exit()
>     fib_notifier_ops_unregister(net->ipv4.notifier_ops)
>       list_del_rcu(&ops->list)
> 
> So fib_seq_sum() can't use rtnl_lock() only for protection.
> 
> The possible solution could be to use rtnl_lock()
> in fib_notifier_ops_unregister(), but this adds
> a possible delay during net namespace creation,
> so we better use rcu_read_lock() till someone
> really needs the mutex (if that happens).
> 
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>

Applied.
diff mbox series

Patch

diff --git a/net/core/fib_notifier.c b/net/core/fib_notifier.c
index 4fc202dbdfb6..fd5c613aea56 100644
--- a/net/core/fib_notifier.c
+++ b/net/core/fib_notifier.c
@@ -34,12 +34,14 @@  static unsigned int fib_seq_sum(void)
 
 	rtnl_lock();
 	for_each_net(net) {
-		list_for_each_entry(ops, &net->fib_notifier_ops, list) {
+		rcu_read_lock();
+		list_for_each_entry_rcu(ops, &net->fib_notifier_ops, list) {
 			if (!try_module_get(ops->owner))
 				continue;
 			fib_seq += ops->fib_seq_read(net);
 			module_put(ops->owner);
 		}
+		rcu_read_unlock();
 	}
 	rtnl_unlock();