From patchwork Wed May 18 09:02:40 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wei Yongjun X-Patchwork-Id: 96138 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1CF9BB6EE9 for ; Wed, 18 May 2011 19:03:14 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755581Ab1ERJDG (ORCPT ); Wed, 18 May 2011 05:03:06 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:63020 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1755814Ab1ERJDF convert rfc822-to-8bit (ORCPT ); Wed, 18 May 2011 05:03:05 -0400 Received: from tang.cn.fujitsu.com (tang.cn.fujitsu.com [10.167.250.3]) by song.cn.fujitsu.com (Postfix) with ESMTP id A1E1B170127; Wed, 18 May 2011 17:02:59 +0800 (CST) Received: from mailserver.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id p4I92xuB032361; Wed, 18 May 2011 17:02:59 +0800 Received: from [10.167.226.141] ([10.167.226.141]) by mailserver.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.1FP4) with ESMTP id 2011051817030779-317685 ; Wed, 18 May 2011 17:03:07 +0800 Message-ID: <4DD38B30.9090601@cn.fujitsu.com> Date: Wed, 18 May 2011 17:02:40 +0800 From: Wei Yongjun User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101208 Thunderbird/3.1.7 MIME-Version: 1.0 To: Jacek Luczak CC: Eric Dumazet , netdev@vger.kernel.org, Vlad Yasevich Subject: Re: [PATCH] SCTP: fix race between sctp_bind_addr_free() and sctp_bind_addr_conflict() References: <1305704885.2983.4.camel@edumazet-laptop> <1305707358.2983.14.camel@edumazet-laptop> In-Reply-To: <1305707358.2983.14.camel@edumazet-laptop> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-05-18 17:03:07, Serialize by Router on mailserver/fnst(Release 8.5.1FP4|July 25, 2010) at 2011-05-18 17:03:08 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org > Le mercredi 18 mai 2011 à 10:06 +0200, Jacek Luczak a écrit : >> 2011/5/18 Eric Dumazet : >>> If you're removing items from this list, you must be a writer here, with >>> exclusive access. So rcu_read_lock()/rcu_read_unlock() is not necessary. >> I could agree to some extend ... but strict RCU section IMO is needed here. >> I can check this if the issue exists. >> > I can tell you for sure rcu_read_lock() is not needed here. Its only > showing confusion from code's author. > > Please read Documentation/RCU/listRCU.txt for concise explanations, > line 117. > > >>> Therefore, I guess following code is better : >>> >>> list_for_each_entry(addr, &bp->address_list, list) { >>> list_del_rcu(&addr->list); >>> call_rcu(&addr->rcu, sctp_local_addr_free); >>> SCTP_DBG_OBJCNT_DEC(addr); >>> } >>> >>> Then, why dont you fix sctp_bind_addr_clean() instead ? >>> >>> if 'struct sctp_sockaddr_entry' is recu protected, then all frees should >>> be protected as well. >> The _clean() as claimed by Vlad is called many times from various places >> in code and this could give a overhead. I guess Vlad would need to comment. > I guess a full review of this code is needed. You'll have to prove > sctp_bind_addr_clean() is always called after one RCU grace period if > you want to leave it as is. > > You cant get RCU for free, some rules must be followed or you risk > crashes. > fix the race between sctp_bind_addr_free() and sctp_bind_addr_conflict(), maybe you just need to remove the socket from the port hash before empty the bind address list. some thing like this, not test. --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c index c8cc24e..924d846 100644 --- a/net/sctp/endpointola.c +++ b/net/sctp/endpointola.c @@ -268,12 +268,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) /* Cleanup. */ sctp_inq_free(&ep->base.inqueue); - sctp_bind_addr_free(&ep->base.bind_addr); /* Remove and free the port */ if (sctp_sk(ep->base.sk)->bind_hash) sctp_put_port(ep->base.sk); + sctp_bind_addr_free(&ep->base.bind_addr); + /* Give up our hold on the sock. */ if (ep->base.sk) sock_put(ep->base.sk);