Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-08 14:23:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

neighbour: fix a race in neigh_destroy()

Browse Source 
There is a race in neighbour code, because neigh_destroy() uses
skb_queue_purge(&neigh->arp_queue) without holding neighbour lock,
while other parts of the code assume neighbour rwlock is what
protects arp_queue

Convert all skb_queue_purge() calls to the __skb_queue_purge() variant

Use __skb_queue_head_init() instead of skb_queue_head_init()
to make clear we do not use arp_queue.lock

And hold neigh->lock in neigh_destroy() to close the race.

Reported-by: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2013-06-28 02:37:42 -07:00 committed by David S. Miller
parent 61369d0259
commit c9ab4d85de
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/core/neighbour.c
View File

@ -231,7 +231,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
we must kill timers etc. and move we must kill timers etc. and move
it to safe state. it to safe state.
*/ */
skb_queue_purge(&n->arp_queue); __skb_queue_purge(&n->arp_queue);
n->arp_queue_len_bytes = 0; n->arp_queue_len_bytes = 0;
n->output = neigh_blackhole; n->output = neigh_blackhole;
if (n->nud_state & NUD_VALID) if (n->nud_state & NUD_VALID)
@ -286,7 +286,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
if (!n) if (!n)
goto out_entries; goto out_entries;
skb_queue_head_init(&n->arp_queue); __skb_queue_head_init(&n->arp_queue);
rwlock_init(&n->lock); rwlock_init(&n->lock);
seqlock_init(&n->ha_lock); seqlock_init(&n->ha_lock);
n->updated = n->used = now; n->updated = n->used = now;
@ -708,7 +708,9 @@ void neigh_destroy(struct neighbour *neigh)
if (neigh_del_timer(neigh)) if (neigh_del_timer(neigh))
pr_warn("Impossible event\n"); pr_warn("Impossible event\n");
skb_queue_purge(&neigh->arp_queue); write_lock_bh(&neigh->lock);
__skb_queue_purge(&neigh->arp_queue);
write_unlock_bh(&neigh->lock);
neigh->arp_queue_len_bytes = 0; neigh->arp_queue_len_bytes = 0;
if (dev->netdev_ops->ndo_neigh_destroy) if (dev->netdev_ops->ndo_neigh_destroy)
@ -858,7 +860,7 @@ static void neigh_invalidate(struct neighbour *neigh)
neigh->ops->error_report(neigh, skb); neigh->ops->error_report(neigh, skb);
write_lock(&neigh->lock); write_lock(&neigh->lock);
} }
skb_queue_purge(&neigh->arp_queue); __skb_queue_purge(&neigh->arp_queue);
neigh->arp_queue_len_bytes = 0; neigh->arp_queue_len_bytes = 0;
} }
@ -1210,7 +1212,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
write_lock_bh(&neigh->lock); write_lock_bh(&neigh->lock);
} }
skb_queue_purge(&neigh->arp_queue); __skb_queue_purge(&neigh->arp_queue);
neigh->arp_queue_len_bytes = 0; neigh->arp_queue_len_bytes = 0;
} }
out: out: