Commit 592fcb9d authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ip: ip_ra_control() rcu fix 



commit 66018506 (ip: Router Alert RCU conversion) introduced RCU
lookups to ip_call_ra_chain(). It missed proper deinit phase :
When ip_ra_control() deletes an ip_ra_chain, it should make sure
ip_call_ra_chain() users can not start to use socket during the rcu
grace period. It should also delay the sock_put() after the grace
period, or we risk a premature socket freeing and corruptions, as
raw sockets are not rcu protected yet.

This delay avoids using expensive atomic_inc_not_zero() in
ip_call_ra_chain().

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 96b52e61

include/net/ip.h

+4 −1
Original line number Diff line number Diff line
@@ -61,7 +61,10 @@ struct ipcm_cookie { 
struct ip_ra_chain {

	struct ip_ra_chain	*next;

	struct sock		*sk;

	union {

		void			(*destructor)(struct sock *);

		struct sock		*saved_sk;

	};

	struct rcu_head		rcu;

};

net/ipv4/ip_sockglue.c

+15 −4
Original line number Diff line number Diff line
@@ -241,9 +241,13 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc) 
struct ip_ra_chain *ip_ra_chain;

static DEFINE_SPINLOCK(ip_ra_lock);



static void ip_ra_free_rcu(struct rcu_head *head)



static void ip_ra_destroy_rcu(struct rcu_head *head)

{

	kfree(container_of(head, struct ip_ra_chain, rcu));

	struct ip_ra_chain *ra = container_of(head, struct ip_ra_chain, rcu);



	sock_put(ra->saved_sk);

	kfree(ra);

}



int ip_ra_control(struct sock *sk, unsigned char on,
@@ -264,13 +268,20 @@ int ip_ra_control(struct sock *sk, unsigned char on, 
				kfree(new_ra);

				return -EADDRINUSE;

			}

			/* dont let ip_call_ra_chain() use sk again */

			ra->sk = NULL;

			rcu_assign_pointer(*rap, ra->next);

			spin_unlock_bh(&ip_ra_lock);



			if (ra->destructor)

				ra->destructor(sk);

			sock_put(sk);

			call_rcu(&ra->rcu, ip_ra_free_rcu);

			/*

			 * Delay sock_put(sk) and kfree(ra) after one rcu grace

			 * period. This guarantee ip_call_ra_chain() dont need

			 * to mess with socket refcounts.

			 */

			ra->saved_sk = sk;

			call_rcu(&ra->rcu, ip_ra_destroy_rcu);

			return 0;

		}

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE