Commit d3092b2e authored Oct 12, 2018 by Tung Nguyen Committed by David S. Miller Oct 15, 2018

tipc: fix unsafe rcu locking when accessing publication list

The binding table's 'cluster_scope' list is rcu protected to handle
races between threads changing the list and those traversing the list at
the same moment. We have now found that the function named_distribute()
uses the regular list_for_each() macro to traverse the said list.
Likewise, the function tipc_named_withdraw() is removing items from the
same list using the regular list_del() call. When these two functions
execute in parallel we see occasional crashes.

This commit fixes this by adding the missing _rcu() suffixes.

Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 7ec8dc96

net/tipc/name_distr.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -115,7 +115,7 @@ struct sk_buff tipc_named_withdraw(struct net net, struct publication *publ)
		struct sk_buff *buf;
		struct distr_item *item;

		list_del(&publ->binding_node);
		list_del_rcu(&publ->binding_node);

		if (publ->scope == TIPC_NODE_SCOPE)
		return NULL;
		@@ -147,7 +147,7 @@ static void named_distribute(struct net net, struct sk_buff_head list,
		ITEM_SIZE) * ITEM_SIZE;
		u32 msg_rem = msg_dsz;

		list_for_each_entry(publ, pls, binding_node) {
		list_for_each_entry_rcu(publ, pls, binding_node) {
		/* Prepare next buffer: */
		if (!skb) {
		skb = named_prepare_buf(net, PUBLICATION, msg_rem,

Admin message