Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d86bef73 authored by Eduardo Blanco's avatar Eduardo Blanco Committed by Simon Horman
Browse files

Fixed race condition at ip_vs.ko module init. 



Lists were initialized after the module was registered.  Multiple ipvsadm
processes at module load triggered a race condition that resulted in a null
pointer dereference in do_ip_vs_get_ctl(). As a result, __ip_vs_mutex
was left locked preventing all further ipvsadm commands.

Signed-off-by: default avatarEduardo J. Blanco <ejblanco@google.com>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent 714f095f

net/netfilter/ipvs/ip_vs_ctl.c

+10 −9
Original line number Diff line number Diff line
@@ -3400,6 +3400,16 @@ int __init ip_vs_control_init(void) 


	EnterFunction(2);



	/* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */

	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {

		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);

		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);

	}

	for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++)  {

		INIT_LIST_HEAD(&ip_vs_rtable[idx]);

	}

	smp_wmb();



	ret = nf_register_sockopt(&ip_vs_sockopts);

	if (ret) {

		pr_err("cannot register sockopt.\n");
@@ -3418,15 +3428,6 @@ int __init ip_vs_control_init(void) 


	sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars);



	/* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */

	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {

		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);

		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);

	}

	for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++)  {

		INIT_LIST_HEAD(&ip_vs_rtable[idx]);

	}



	ip_vs_new_estimator(&ip_vs_stats);



	/* Hook the defense timer */