leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipv6: fix a potential deadlock in do_ipv6_setsockopt()

Browse Source 
Baozeng reported this deadlock case:

       CPU0                    CPU1
       ----                    ----
  lock([  165.136033] sk_lock-AF_INET6);
                               lock([  165.136033] rtnl_mutex);
                               lock([  165.136033] sk_lock-AF_INET6);
  lock([  165.136033] rtnl_mutex);

Similar to commit 87e9f03159
("ipv4: fix a potential deadlock in mcast getsockopt() path")
this is due to we still have a case, ipv6_sock_mc_close(),
where we acquire sk_lock before rtnl_lock. Close this deadlock
with the similar solution, that is always acquire rtnl lock first.

Fixes: baf606d9c9 ("ipv4,ipv6: grab rtnl before locking the socket")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Tested-by: Baozeng Ding <sploving1@gmail.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
WANG Cong
2016-10-19 23:35:12 -07:00
committed by David S. Miller
parent 8dbad1a811
commit 8651be8f14
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/addrconf.h
View File

@@ -174,6 +174,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex,
const struct in6_addr *addr); const struct in6_addr *addr);
int ipv6_sock_mc_drop(struct sock *sk, int ifindex, int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
const struct in6_addr *addr); const struct in6_addr *addr);
void __ipv6_sock_mc_close(struct sock *sk);
void ipv6_sock_mc_close(struct sock *sk); void ipv6_sock_mc_close(struct sock *sk);
bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr, bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
const struct in6_addr *src_addr); const struct in6_addr *src_addr);

3
net/ipv6/ipv6_sockglue.c
View File

@@ -120,6 +120,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
static bool setsockopt_needs_rtnl(int optname) static bool setsockopt_needs_rtnl(int optname)
{ {
switch (optname) { switch (optname) {
case IPV6_ADDRFORM:
case IPV6_ADD_MEMBERSHIP: case IPV6_ADD_MEMBERSHIP:
case IPV6_DROP_MEMBERSHIP: case IPV6_DROP_MEMBERSHIP:
case IPV6_JOIN_ANYCAST: case IPV6_JOIN_ANYCAST:
@@ -198,7 +199,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
} }
fl6_free_socklist(sk); fl6_free_socklist(sk);
ipv6_sock_mc_close(sk); __ipv6_sock_mc_close(sk);
/* /*
* Sock is moving from IPv6 to IPv4 (sk_prot), so * Sock is moving from IPv6 to IPv4 (sk_prot), so

17
net/ipv6/mcast.c
View File

@@ -276,16 +276,14 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
return idev; return idev;
} }
void ipv6_sock_mc_close(struct sock *sk) void __ipv6_sock_mc_close(struct sock *sk)
{ {
struct ipv6_pinfo *np = inet6_sk(sk); struct ipv6_pinfo *np = inet6_sk(sk);
struct ipv6_mc_socklist *mc_lst; struct ipv6_mc_socklist *mc_lst;
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
if (!rcu_access_pointer(np->ipv6_mc_list)) ASSERT_RTNL();
return;
rtnl_lock();
while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) { while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) {
struct net_device *dev; struct net_device *dev;
@@ -303,8 +301,17 @@ void ipv6_sock_mc_close(struct sock *sk)
atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc); atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
kfree_rcu(mc_lst, rcu); kfree_rcu(mc_lst, rcu);
} }
}
void ipv6_sock_mc_close(struct sock *sk)
{
struct ipv6_pinfo *np = inet6_sk(sk);
if (!rcu_access_pointer(np->ipv6_mc_list))
return;
rtnl_lock();
__ipv6_sock_mc_close(sk);
rtnl_unlock(); rtnl_unlock();
} }