Commit 3185485c authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mctp-incorrect-addr-refs' 



Matt Johnston says:

====================
mctp: Fix incorrect refs for extended addr

This fixes an incorrect netdev unref and also addresses the race
condition identified by Jakub in v2. Thanks for the review.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4767b7e2 e297db3e

net/mctp/device.c

+18 −3
Original line number Diff line number Diff line
@@ -25,12 +25,25 @@ struct mctp_dump_cb { 
	size_t a_idx;

};



/* unlocked: caller must hold rcu_read_lock */

/* unlocked: caller must hold rcu_read_lock.

 * Returned mctp_dev has its refcount incremented, or NULL if unset.

 */

struct mctp_dev *__mctp_dev_get(const struct net_device *dev)

{

	return rcu_dereference(dev->mctp_ptr);

	struct mctp_dev *mdev = rcu_dereference(dev->mctp_ptr);



	/* RCU guarantees that any mdev is still live.

	 * Zero refcount implies a pending free, return NULL.

	 */

	if (mdev)

		if (!refcount_inc_not_zero(&mdev->refs))

			return NULL;

	return mdev;

}



/* Returned mctp_dev does not have refcount incremented. The returned pointer

 * remains live while rtnl_lock is held, as that prevents mctp_unregister()

 */

struct mctp_dev *mctp_dev_get_rtnl(const struct net_device *dev)

{

	return rtnl_dereference(dev->mctp_ptr);
@@ -124,6 +137,7 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) 
				if (mdev) {

					rc = mctp_dump_dev_addrinfo(mdev,

								    skb, cb);

					mctp_dev_put(mdev);

					// Error indicates full buffer, this

					// callback will get retried.

					if (rc < 0)
@@ -298,7 +312,7 @@ void mctp_dev_hold(struct mctp_dev *mdev) 


void mctp_dev_put(struct mctp_dev *mdev)

{

	if (refcount_dec_and_test(&mdev->refs)) {

	if (mdev && refcount_dec_and_test(&mdev->refs)) {

		dev_put(mdev->dev);

		kfree_rcu(mdev, rcu);

	}
@@ -370,6 +384,7 @@ static size_t mctp_get_link_af_size(const struct net_device *dev, 
	if (!mdev)

		return 0;

	ret = nla_total_size(4); /* IFLA_MCTP_NET */

	mctp_dev_put(mdev);

	return ret;

}

net/mctp/route.c

+6 −7
Original line number Diff line number Diff line
@@ -836,9 +836,8 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
{

	struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk);

	struct mctp_skb_cb *cb = mctp_cb(skb);

	struct mctp_route tmp_rt;

	struct mctp_route tmp_rt = {0};

	struct mctp_sk_key *key;

	struct net_device *dev;

	struct mctp_hdr *hdr;

	unsigned long flags;

	unsigned int mtu;
@@ -851,12 +850,12 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 


	if (rt) {

		ext_rt = false;

		dev = NULL;



		if (WARN_ON(!rt->dev))

			goto out_release;



	} else if (cb->ifindex) {

		struct net_device *dev;



		ext_rt = true;

		rt = &tmp_rt;
@@ -866,7 +865,6 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
			rcu_read_unlock();

			return rc;

		}



		rt->dev = __mctp_dev_get(dev);

		rcu_read_unlock();
@@ -947,10 +945,9 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
	if (!ext_rt)

		mctp_route_release(rt);



	dev_put(dev);

	mctp_dev_put(tmp_rt.dev);



	return rc;



}



/* route management */
@@ -1124,11 +1121,13 @@ static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev, 


	rt->output(rt, skb);

	mctp_route_release(rt);

	mctp_dev_put(mdev);



	return NET_RX_SUCCESS;



err_drop:

	kfree_skb(skb);

	mctp_dev_put(mdev);

	return NET_RX_DROP;

}

net/mctp/test/utils.c

+0 −1
Original line number Diff line number Diff line
@@ -54,7 +54,6 @@ struct mctp_test_dev *mctp_test_create_dev(void) 


	rcu_read_lock();

	dev->mdev = __mctp_dev_get(ndev);

	mctp_dev_hold(dev->mdev);

	rcu_read_unlock();



	return dev;