Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9cce0157 authored by Eric Dumazet's avatar Eric Dumazet Committed by Subash Abhinov Kasiviswanathan
Browse files

Crash due to mutex genl_lock called from RCU context 



Grabbing the mutex should not be done from netlink_sock_destruct() but
from netlink_release()

CRs-Fixed: 1094434
Change-Id: I69ae0d8589a0878b9758619893848afc272179c5
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Patch-mainline: linux-netdev @ 11/26/16, 04:54
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 68610ce9

net/netlink/af_netlink.c

+17 −20
Original line number Diff line number Diff line
@@ -926,16 +926,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) 


static void netlink_sock_destruct(struct sock *sk)

{

	struct netlink_sock *nlk = nlk_sk(sk);



	if (nlk->cb_running) {

		if (nlk->cb.done)

			nlk->cb.done(&nlk->cb);



		module_put(nlk->cb.module);

		kfree_skb(nlk->cb.skb);

	}



	skb_queue_purge(&sk->sk_receive_queue);

#ifdef CONFIG_NETLINK_MMAP

	if (1) {
@@ -1070,8 +1060,9 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid) 


	rcu_read_lock();

	sk = __netlink_lookup(table, portid, net);

	if (sk)

		sock_hold(sk);

	if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))

		sk = NULL;



	rcu_read_unlock();



	return sk;
@@ -1198,6 +1189,7 @@ static int __netlink_create(struct net *net, struct socket *sock, 
	mutex_init(&nlk->pg_vec_lock);

#endif



	sock_set_flag(sk, SOCK_RCU_FREE);

	sk->sk_destruct = netlink_sock_destruct;

	sk->sk_protocol = protocol;

	return 0;
@@ -1262,13 +1254,6 @@ out_module: 
	goto out;

}



static void deferred_put_nlk_sk(struct rcu_head *head)

{

	struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);



	sock_put(&nlk->sk);

}



static int netlink_release(struct socket *sock)

{

	struct sock *sk = sock->sk;
@@ -1341,7 +1326,19 @@ static int netlink_release(struct socket *sock) 
	local_bh_disable();

	sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);

	local_bh_enable();

	call_rcu(&nlk->rcu, deferred_put_nlk_sk);

	if (nlk->cb_running) {

		mutex_lock(nlk->cb_mutex);

		if (nlk->cb_running) {

			if (nlk->cb.done)

				nlk->cb.done(&nlk->cb);



			module_put(nlk->cb.module);

			kfree_skb(nlk->cb.skb);

			nlk->cb_running = false;

		}

		mutex_unlock(nlk->cb_mutex);

	}

	sock_put(sk);

	return 0;

}

net/netlink/af_netlink.h

+0 −1
Original line number Diff line number Diff line
@@ -52,7 +52,6 @@ struct netlink_sock { 
#endif /* CONFIG_NETLINK_MMAP */



	struct rhash_head	node;

	struct rcu_head		rcu;

};



static inline struct netlink_sock *nlk_sk(struct sock *sk)