Commit dc121c00 authored by Matt Johnston's avatar Matt Johnston Committed by David S. Miller
Browse files

mctp: make __mctp_dev_get() take a refcount hold 



Previously there was a race that could allow the mctp_dev refcount
to hit zero:

rcu_read_lock();
mdev = __mctp_dev_get(dev);
// mctp_unregister() happens here, mdev->refs hits zero
mctp_dev_hold(dev);
rcu_read_unlock();

Now we make __mctp_dev_get() take the hold itself. It is safe to test
against the zero refcount because __mctp_dev_get() is called holding
rcu_read_lock and mctp_dev uses kfree_rcu().

Reported-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarMatt Johnston <matt@codeconstruct.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4767b7e2

net/mctp/device.c

+18 −3
Original line number Diff line number Diff line
@@ -25,12 +25,25 @@ struct mctp_dump_cb { 
	size_t a_idx;

};



/* unlocked: caller must hold rcu_read_lock */

/* unlocked: caller must hold rcu_read_lock.

 * Returned mctp_dev has its refcount incremented, or NULL if unset.

 */

struct mctp_dev *__mctp_dev_get(const struct net_device *dev)

{

	return rcu_dereference(dev->mctp_ptr);

	struct mctp_dev *mdev = rcu_dereference(dev->mctp_ptr);



	/* RCU guarantees that any mdev is still live.

	 * Zero refcount implies a pending free, return NULL.

	 */

	if (mdev)

		if (!refcount_inc_not_zero(&mdev->refs))

			return NULL;

	return mdev;

}



/* Returned mctp_dev does not have refcount incremented. The returned pointer

 * remains live while rtnl_lock is held, as that prevents mctp_unregister()

 */

struct mctp_dev *mctp_dev_get_rtnl(const struct net_device *dev)

{

	return rtnl_dereference(dev->mctp_ptr);
@@ -124,6 +137,7 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb) 
				if (mdev) {

					rc = mctp_dump_dev_addrinfo(mdev,

								    skb, cb);

					mctp_dev_put(mdev);

					// Error indicates full buffer, this

					// callback will get retried.

					if (rc < 0)
@@ -298,7 +312,7 @@ void mctp_dev_hold(struct mctp_dev *mdev) 


void mctp_dev_put(struct mctp_dev *mdev)

{

	if (refcount_dec_and_test(&mdev->refs)) {

	if (mdev && refcount_dec_and_test(&mdev->refs)) {

		dev_put(mdev->dev);

		kfree_rcu(mdev, rcu);

	}
@@ -370,6 +384,7 @@ static size_t mctp_get_link_af_size(const struct net_device *dev, 
	if (!mdev)

		return 0;

	ret = nla_total_size(4); /* IFLA_MCTP_NET */

	mctp_dev_put(mdev);

	return ret;

}

net/mctp/route.c

+4 −1
Original line number Diff line number Diff line
@@ -836,7 +836,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
{

	struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk);

	struct mctp_skb_cb *cb = mctp_cb(skb);

	struct mctp_route tmp_rt;

	struct mctp_route tmp_rt = {0};

	struct mctp_sk_key *key;

	struct net_device *dev;

	struct mctp_hdr *hdr;
@@ -948,6 +948,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
		mctp_route_release(rt);



	dev_put(dev);

	mctp_dev_put(tmp_rt.dev);



	return rc;
@@ -1124,11 +1125,13 @@ static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev, 


	rt->output(rt, skb);

	mctp_route_release(rt);

	mctp_dev_put(mdev);



	return NET_RX_SUCCESS;



err_drop:

	kfree_skb(skb);

	mctp_dev_put(mdev);

	return NET_RX_DROP;

}

net/mctp/test/utils.c

+0 −1
Original line number Diff line number Diff line
@@ -54,7 +54,6 @@ struct mctp_test_dev *mctp_test_create_dev(void) 


	rcu_read_lock();

	dev->mdev = __mctp_dev_get(ndev);

	mctp_dev_hold(dev->mdev);

	rcu_read_unlock();



	return dev;