Commit 9a375803 authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by David S. Miller
Browse files

inet fragments: fix race between inet_frag_find and inet_frag_secret_rebuild 



The problem is that while we work w/o the inet_frags.lock even
read-locked the secret rebuild timer may occur (on another CPU, since
BHs are still disabled in the inet_frag_find) and change the rnd seed
for ipv4/6 fragments.

It was caused by my patch fd9e6354
([INET]: Omit double hash calculations in xxx_frag_intern) late 
in the 2.6.24 kernel, so this should probably be queued to -stable.

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a0a61a60

net/ipv4/inet_fragment.c

+11 −5
Original line number Diff line number Diff line
@@ -192,14 +192,21 @@ EXPORT_SYMBOL(inet_frag_evictor); 


static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,

		struct inet_frag_queue *qp_in, struct inet_frags *f,

		unsigned int hash, void *arg)

		void *arg)

{

	struct inet_frag_queue *qp;

#ifdef CONFIG_SMP

	struct hlist_node *n;

#endif

	unsigned int hash;



	write_lock(&f->lock);

	/*

	 * While we stayed w/o the lock other CPU could update

	 * the rnd seed, so we need to re-calculate the hash

	 * chain. Fortunatelly the qp_in can be used to get one.

	 */

	hash = f->hashfn(qp_in);

#ifdef CONFIG_SMP

	/* With SMP race we have to recheck hash table, because

	 * such entry could be created on other cpu, while we
@@ -247,7 +254,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, 
}



static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,

		struct inet_frags *f, void *arg, unsigned int hash)

		struct inet_frags *f, void *arg)

{

	struct inet_frag_queue *q;
@@ -255,7 +262,7 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, 
	if (q == NULL)

		return NULL;



	return inet_frag_intern(nf, q, f, hash, arg);

	return inet_frag_intern(nf, q, f, arg);

}



struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
@@ -264,7 +271,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, 
	struct inet_frag_queue *q;

	struct hlist_node *n;



	read_lock(&f->lock);

	hlist_for_each_entry(q, n, &f->hash[hash], list) {

		if (q->net == nf && f->match(q, key)) {

			atomic_inc(&q->refcnt);
@@ -274,6 +280,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, 
	}

	read_unlock(&f->lock);



	return inet_frag_create(nf, f, key, hash);

	return inet_frag_create(nf, f, key);

}

EXPORT_SYMBOL(inet_frag_find);

net/ipv4/ip_fragment.c

+2 −0
Original line number Diff line number Diff line
@@ -229,6 +229,8 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user) 


	arg.iph = iph;

	arg.user = user;



	read_lock(&ip4_frags.lock);

	hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);



	q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);

net/ipv6/netfilter/nf_conntrack_reasm.c

+2 −1
Original line number Diff line number Diff line
@@ -207,9 +207,10 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst) 
	arg.id = id;

	arg.src = src;

	arg.dst = dst;



	read_lock_bh(&nf_frags.lock);

	hash = ip6qhashfn(id, src, dst);



	local_bh_disable();

	q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);

	local_bh_enable();

	if (q == NULL)

net/ipv6/reassembly.c

+2 −0
Original line number Diff line number Diff line
@@ -247,6 +247,8 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst, 
	arg.id = id;

	arg.src = src;

	arg.dst = dst;



	read_lock(&ip6_frags.lock);

	hash = ip6qhashfn(id, src, dst);



	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);

CRA Git | Maintained and supported by SUSTech CRA and CCSE