Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e8fcbf6 authored by Alexey Kuznetsov's avatar Alexey Kuznetsov Committed by David S. Miller
Browse files

[IPV4]: severe locking bug in fib_semantics.c 



Found in 2.4 by Yixin Pan <yxpan@hotmail.com>.

> When I read fib_semantics.c of Linux-2.4.32, write_lock(&fib_info_lock) =
> is used in fib_release_info() instead of write_lock_bh(&fib_info_lock).  =
> Is the following case possible: a BH interrupts fib_release_info() while =
> holding the write lock, and calls ip_check_fib_default() which calls =
> read_lock(&fib_info_lock), and spin forever.

Signed-off-by: default avatarAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent acd6e00b

net/ipv4/fib_semantics.c

+6 −6
Original line number Original line Diff line number Diff line
@@ -159,7 +159,7 @@ void free_fib_info(struct fib_info *fi) 




void fib_release_info(struct fib_info *fi)

void fib_release_info(struct fib_info *fi)

{

{

	write_lock(&fib_info_lock);

	write_lock_bh(&fib_info_lock);

	if (fi && --fi->fib_treeref == 0) {

	if (fi && --fi->fib_treeref == 0) {

		hlist_del(&fi->fib_hash);

		hlist_del(&fi->fib_hash);

		if (fi->fib_prefsrc)

		if (fi->fib_prefsrc)
@@ -172,7 +172,7 @@ void fib_release_info(struct fib_info *fi) 
		fi->fib_dead = 1;

		fi->fib_dead = 1;

		fib_info_put(fi);

		fib_info_put(fi);

	}

	}

	write_unlock(&fib_info_lock);

	write_unlock_bh(&fib_info_lock);

}

}





static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi)

static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi)
@@ -598,7 +598,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash, 
	unsigned int old_size = fib_hash_size;

	unsigned int old_size = fib_hash_size;

	unsigned int i, bytes;

	unsigned int i, bytes;





	write_lock(&fib_info_lock);

	write_lock_bh(&fib_info_lock);

	old_info_hash = fib_info_hash;

	old_info_hash = fib_info_hash;

	old_laddrhash = fib_info_laddrhash;

	old_laddrhash = fib_info_laddrhash;

	fib_hash_size = new_size;

	fib_hash_size = new_size;
@@ -639,7 +639,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash, 
	}

	}

	fib_info_laddrhash = new_laddrhash;

	fib_info_laddrhash = new_laddrhash;





	write_unlock(&fib_info_lock);

	write_unlock_bh(&fib_info_lock);





	bytes = old_size * sizeof(struct hlist_head *);

	bytes = old_size * sizeof(struct hlist_head *);

	fib_hash_free(old_info_hash, bytes);

	fib_hash_free(old_info_hash, bytes);
@@ -820,7 +820,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta, 




	fi->fib_treeref++;

	fi->fib_treeref++;

	atomic_inc(&fi->fib_clntref);

	atomic_inc(&fi->fib_clntref);

	write_lock(&fib_info_lock);

	write_lock_bh(&fib_info_lock);

	hlist_add_head(&fi->fib_hash,

	hlist_add_head(&fi->fib_hash,

		       &fib_info_hash[fib_info_hashfn(fi)]);

		       &fib_info_hash[fib_info_hashfn(fi)]);

	if (fi->fib_prefsrc) {

	if (fi->fib_prefsrc) {
@@ -839,7 +839,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta, 
		head = &fib_info_devhash[hash];

		head = &fib_info_devhash[hash];

		hlist_add_head(&nh->nh_hash, head);

		hlist_add_head(&nh->nh_hash, head);

	} endfor_nexthops(fi)

	} endfor_nexthops(fi)

	write_unlock(&fib_info_lock);

	write_unlock_bh(&fib_info_lock);

	return fi;

	return fi;





err_inval:

err_inval: