Commit 46bcf14f authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

filter: fix sk_filter rcu handling 



Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and
sk_clone() in commit 47e958ea

Problem is we can have several clones sharing a common sk_filter, and
these clones might want to sk_filter_attach() their own filters at the
same time, and can overwrite old_filter->rcu, corrupting RCU queues.

We can not use filter->rcu without being sure no other thread could do
the same thing.

Switch code to a more conventional ref-counting technique : Do the
atomic decrement immediately and queue one rcu call back when last
reference is released.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e7dfc8db

include/net/sock.h

+3 −1
Original line number Diff line number Diff line
@@ -1155,6 +1155,8 @@ extern void sk_common_release(struct sock *sk); 
/* Initialise core socket variables */

extern void sock_init_data(struct socket *sock, struct sock *sk);



extern void sk_filter_release_rcu(struct rcu_head *rcu);



/**

 *	sk_filter_release - release a socket filter

 *	@fp: filter to remove
@@ -1165,7 +1167,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk); 
static inline void sk_filter_release(struct sk_filter *fp)

{

	if (atomic_dec_and_test(&fp->refcnt))

		kfree(fp);

		call_rcu_bh(&fp->rcu, sk_filter_release_rcu);

}



static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)

net/core/filter.c

+6 −13
Original line number Diff line number Diff line
@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *filter, int flen) 
EXPORT_SYMBOL(sk_chk_filter);



/**

 * 	sk_filter_rcu_release - Release a socket filter by rcu_head

 * 	sk_filter_release_rcu - Release a socket filter by rcu_head

 *	@rcu: rcu_head that contains the sk_filter to free

 */

static void sk_filter_rcu_release(struct rcu_head *rcu)

void sk_filter_release_rcu(struct rcu_head *rcu)

{

	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);



	sk_filter_release(fp);

}



static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)

{

	unsigned int size = sk_filter_len(fp);



	atomic_sub(size, &sk->sk_omem_alloc);

	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);

	kfree(fp);

}

EXPORT_SYMBOL(sk_filter_release_rcu);



/**

 *	sk_attach_filter - attach a socket filter
@@ -649,7 +642,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) 
	rcu_assign_pointer(sk->sk_filter, fp);



	if (old_fp)

		sk_filter_delayed_uncharge(sk, old_fp);

		sk_filter_uncharge(sk, old_fp);

	return 0;

}

EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -663,7 +656,7 @@ int sk_detach_filter(struct sock *sk) 
					   sock_owned_by_user(sk));

	if (filter) {

		rcu_assign_pointer(sk->sk_filter, NULL);

		sk_filter_delayed_uncharge(sk, filter);

		sk_filter_uncharge(sk, filter);

		ret = 0;

	}

	return ret;

CRA Git | Maintained and supported by SUSTech CRA and CCSE