| Message ID | 20180221034159.14685-1-Jason@zx2c4.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | netlink: put module reference if dump start fails | expand |
On Wed, 2018-02-21 at 04:41 +0100, Jason A. Donenfeld wrote: > Before, if cb->start() failed, the module reference would never be put, > because cb->cb_running is intentionally false at this point. Users are > generally annoyed by this because they can no longer unload modules that > leak references. Also, it may be possible to tediously wrap a reference > counter back to zero, especially since module.c still uses atomic_inc > instead of refcount_inc. > > This patch expands the error path to simply call module_put if > cb->start() fails. > > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> > --- > This probably should be queued up for stable. When was the bug added ? This would help a lot stable teams ... Thanks.
On Wed, Feb 21, 2018 at 6:47 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote: >> This probably should be queued up for stable. > > When was the bug added ? This would help a lot stable teams ... This needs to be backported to 4.16-rc0+, 4.15+, 4.14+, 4.13.14+, and 4.9.63+.
On Wed, 2018-02-21 at 15:54 +0100, Jason A. Donenfeld wrote: > On Wed, Feb 21, 2018 at 6:47 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > > > This probably should be queued up for stable. > > > > When was the bug added ? This would help a lot stable teams ... > > This needs to be backported to 4.16-rc0+, 4.15+, 4.14+, 4.13.14+, and 4.9.63+. I guess I should have asked you to provide an appropriate Fixes: tag, clearly identifying the commit that added the bug. Fixes: 12-digit-sha1 ("patch title") Thanks.
Fixes: 41c87425a1ac ("netlink: do not set cb_running if dump's start() errs")
Hi,
On Wed, Feb 21, 2018 at 04:41:05PM +0100, Jason A. Donenfeld wrote:
>Fixes: 41c87425a1ac ("netlink: do not set cb_running if dump's start() errs")
I think you Would better to resend it.
Bo,
From: "Jason A. Donenfeld" <Jason@zx2c4.com> Date: Wed, 21 Feb 2018 04:41:59 +0100 > Before, if cb->start() failed, the module reference would never be put, > because cb->cb_running is intentionally false at this point. Users are > generally annoyed by this because they can no longer unload modules that > leak references. Also, it may be possible to tediously wrap a reference > counter back to zero, especially since module.c still uses atomic_inc > instead of refcount_inc. > > This patch expands the error path to simply call module_put if > cb->start() fails. > > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> > --- > This probably should be queued up for stable. Applied and queued up for -stable.
Thanks! Jason
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 2ad445c1d27c..07e8478068f0 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2308,7 +2308,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, if (cb->start) { ret = cb->start(cb); if (ret) - goto error_unlock; + goto error_put; } nlk->cb_running = true; @@ -2328,6 +2328,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, */ return -EINTR; +error_put: + module_put(control->module); error_unlock: sock_put(sk); mutex_unlock(nlk->cb_mutex);
Before, if cb->start() failed, the module reference would never be put, because cb->cb_running is intentionally false at this point. Users are generally annoyed by this because they can no longer unload modules that leak references. Also, it may be possible to tediously wrap a reference counter back to zero, especially since module.c still uses atomic_inc instead of refcount_inc. This patch expands the error path to simply call module_put if cb->start() fails. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- This probably should be queued up for stable. net/netlink/af_netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)