OpenVZ Forum: Devel » [PATCH] Don't attach callback to a going-away netlink socket

Home » Mailing lists » Devel » [PATCH] Don't attach callback to a going-away netlink socket

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

[PATCH] Don't attach callback to a going-away netlink socket [message #12043]

Mon, 16 April 2007 11:34

xemul
Messages: 248
Registered: November 2005

Senior Member

From: Denis Lunev <den@openvz.org>

There is a race between netlink_dump_start() and netlink_release()
that can lead to the situation when a netlink socket with non-zero
callback is freed.

--- a/net/netlink/af_netlink.c 2004-10-25 12:12:23.000000000 +0400
+++ b/net/netlink/af_netlink.c 2004-10-28 16:26:12.000000000 +0400
@@ -255,6 +255,7 @@ static int netlink_release(struct socket
return 0;

netlink_remove(sk);
+ sock_orphan(sk);
nlk = nlk_sk(sk);

spin_lock(&nlk->cb_lock);
@@ -269,7 +270,6 @@ static int netlink_release(struct socket
/* OK. Socket is unlinked, and, therefore,
no new packets will arrive */

- sock_orphan(sk);
sock->sk = NULL;
wake_up_interruptible_all(&nlk->wait);

@@ -942,9 +942,9 @@ int netlink_dump_start(struct sock *ssk,
return -ECONNREFUSED;
}
nlk = nlk_sk(sk);
- /* A dump is in progress... */
+ /* A dump or destruction is in progress... */
spin_lock(&nlk->cb_lock);
- if (nlk->cb) {
+ if (nlk->cb || sock_flag(sk, SOCK_DEAD)) {
spin_unlock(&nlk->cb_lock);
netlink_destroy_callback(cb);
sock_put(sk);

Report message to a moderator

Re: [PATCH] Don't attach callback to a going-away netlink socket [message #12044 is a reply to message #12043]

Mon, 16 April 2007 11:41

Patrick McHardy
Messages: 107
Registered: March 2006

Senior Member

Pavel Emelianov wrote:
> From: Denis Lunev <den@openvz.org>
>
> There is a race between netlink_dump_start() and netlink_release()
> that can lead to the situation when a netlink socket with non-zero
> callback is freed.

Can you describe the race in more detail please?

Report message to a moderator

Re: [PATCH] Don't attach callback to a going-away netlink socket [message #12046 is a reply to message #12044]

Mon, 16 April 2007 11:53

xemul
Messages: 248
Registered: November 2005

Senior Member

Patrick McHardy wrote:
> Pavel Emelianov wrote:
>> From: Denis Lunev <den@openvz.org>
>>
>> There is a race between netlink_dump_start() and netlink_release()
>> that can lead to the situation when a netlink socket with non-zero
>> callback is freed.
>
>
> Can you describe the race in more detail please?
>
>

Here it is:

CPU1: CPU2
netlink_release(): netlink_dump_start():

sk = netlink_lookup(); /* OK */

netlink_remove();

spin_lock(&nlk->cb_lock);
if (nlk->cb) { /* false */
...
}
spin_unlock(&nlk->cb_lock);

spin_lock(&nlk->cb_lock);
if (nlk->cb) { /* false */
...
}
nlk->cb = cb;
spin_unlock(&nlk->cb_lock);
...
sock_orphan(sk);
/*
* proceed with releasing
* the socket
*/

The proposal it to make sock_orphan before detaching the callback
in netlink_release() and to check for the sock to be SOCK_DEAD in
netlink_dump_start() before setting a new callback.

Report message to a moderator

Re: [PATCH] Don't attach callback to a going-away netlink socket [message #12049 is a reply to message #12046]

Mon, 16 April 2007 12:55

Patrick McHardy
Messages: 107
Registered: March 2006

Senior Member

Pavel Emelianov wrote:
> Patrick McHardy wrote:
>
>>>There is a race between netlink_dump_start() and netlink_release()
>>>that can lead to the situation when a netlink socket with non-zero
>>>callback is freed.
>>
>>
>>Can you describe the race in more detail please?
>>
>
> Here it is:
>
> [...]
> The proposal it to make sock_orphan before detaching the callback
> in netlink_release() and to check for the sock to be SOCK_DEAD in
> netlink_dump_start() before setting a new callback.

Thanks, good catch. Your patch also looks good.

Acked-by: Patrick McHardy <kaber@trash.net>

Report message to a moderator

Re: [PATCH] Don't attach callback to a going-away netlink socket [message #12052 is a reply to message #12043]

Mon, 16 April 2007 12:37

James Morris
Messages: 10
Registered: March 2006

Junior Member

Please post networking patches to the networking developer list:

http://vger.kernel.org/vger-lists.html#netdev

- James
--
James Morris
<jmorris@namei.org>

Report message to a moderator

Previous Topic:	How to query mount propagation state?
Next Topic:	[PATCH] Report that kernel is tainted if there were an OOPS before

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Mon Oct 07 12:09:20 GMT 2024

Total time taken to generate the page: 0.05214 seconds