Commit 5a60fc9d authored by Di Zhu's avatar Di Zhu Committed by Zheng Zengkai
Browse files

net: fix a data race when get vlan device

mainline inclusion
from mainline-v5.13-rc1
commit c1102e9d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4RJ4X


CVE: NA

----------------------------

We encountered a crash: in the packet receiving process, we got an
illegal VLAN device address, but the VLAN device address saved in vmcore
is correct. After checking the code, we found a possible data
competition:
CPU 0:                             CPU 1:
    (RCU read lock)                  (RTNL lock)
    vlan_do_receive()		       register_vlan_dev()
      vlan_find_dev()

        ->__vlan_group_get_device()	 ->vlan_group_prealloc_vid()

In vlan_group_prealloc_vid(), We need to make sure that memset()
in kzalloc() is executed before assigning  value to vlan devices array:
=================================
kzalloc()
    ->memset(object, 0, size)

smp_wmb()

vg->vlan_devices_arrays[pidx][vidx] = array;
==================================

Because __vlan_group_get_device() function depends on this order.
otherwise we may get a wrong address from the hardware cache on
another cpu.

So fix it by adding memory barrier instruction to ensure the order
of memory operations.

Signed-off-by: default avatarDi Zhu <zhudi21@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Reviewed-by: default avatarwuchangye <wuchangye@huawei.com>
Reviewed-by: default avatarWei Yongjun <weiyongjun1@huawei.com>

Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent b6461fe5
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment