[PATCH 3.2 14/77] mac80211: mesh: fix call_rcu() usage

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 14/77] mac80211: mesh: fix call_rcu() usage
Date	2015-12-24 17:00 +0100
Message-ID	<qJgt7-aL-75@gated-at.bofh.it> (permalink)
References	<qJgjn-6R-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.2.75-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit c2e703a55245bfff3db53b1f7cbe59f1ee8a4339 upstream.

When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.

Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.

This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.

Fixes: eb2b9311fd00 ("mac80211: mesh path table implementation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/mac80211/mesh_pathtbl.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -779,10 +779,8 @@ void mesh_plink_broken(struct sta_info *
 static void mesh_path_node_reclaim(struct rcu_head *rp)
 {
 	struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
 
 	del_timer_sync(&node->mpath->timer);
-	atomic_dec(&sdata->u.mesh.mpaths);
 	kfree(node->mpath);
 	kfree(node);
 }
@@ -790,8 +788,9 @@ static void mesh_path_node_reclaim(struc
 /* needs to be called with the corresponding hashwlock taken */
 static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
 {
-	struct mesh_path *mpath;
-	mpath = node->mpath;
+	struct mesh_path *mpath = node->mpath;
+	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+
 	spin_lock(&mpath->state_lock);
 	mpath->flags |= MESH_PATH_RESOLVING;
 	if (mpath->is_gate)
@@ -799,6 +798,7 @@ static void __mesh_path_del(struct mesh_
 	hlist_del_rcu(&node->list);
 	call_rcu(&node->rcu, mesh_path_node_reclaim);
 	spin_unlock(&mpath->state_lock);
+	atomic_dec(&sdata->u.mesh.mpaths);
 	atomic_dec(&tbl->entries);
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[PATCH 3.2 00/77] 3.2.75-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 16:50 +0100
  [PATCH 3.2 43/77] dm btree: fix leak of bufio-backed block in  btree_split_sibling error path Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 73/77] bluetooth: Validate socket address length in   sco_sock_bind(). Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 31/77] broadcom: fix PHY_ID_BCM5481 entry in the id table Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 08/77] USB: ti_usb_3410_502: Fix ID table size Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 04/77] ALSA: usb-audio: prevent CH345 multiport output  SysEx corruption Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 76/77] isdn_ppp: Add checks for allocation failure in  isdn_ppp_open() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 18/77] USB: option: add XS Stick W100-2 from 4G Systems Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 28/77] fix sysvfs symlinks Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 56/77] mm, vmstat: allow WQ concurrency to discover  memory reclaim doesn't make any progress Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 22/77] net: ip6mr: fix static mfc/dev leaks on table  destruction Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 37/77] drm/ttm: Fixed a read/write lock imbalance Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 52/77] ipmi: move timer init to before irq is setup Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 50/77] ALSA: rme96: Fix unexpected volume reset after  rate changes Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 64/77] dccp: remove unnecessary codes in ipv6.c Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 68/77] sctp: update the netstamp_needed counter when  copying  sockets Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 16/77] xhci: Add XHCI_INTEL_HOST quirk Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 15/77] macvlan: fix leak in macvlan_handle_frame Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 65/77] ipv6: add complete rcu protection around np->opt Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 09/77] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 17/77] xhci: Workaround to get Intel xHCI reset  working more reliably Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 05/77] ALSA: usb-audio: work around CH345 input SysEx  corruption Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 67/77] atl1c: Improve driver not to do order 4  GFP_ATOMIC  allocation Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 19/77] usblp: do not set TASK_INTERRUPTIBLE before lock Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 55/77] parisc iommu: fix panic due to trying to  allocate too large region Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 62/77] net: ipmr: fix static mfc/dev leaks on table   destruction Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 30/77] vfs: Avoid softlockups with sendfile(2) Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 10/77] usb: musb: core: fix order of arguments to ulpi  write callback Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 59/77] snmp: Remove duplicate OUTMCAST stat increment Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 24/77] USB: cp210x: Remove CP2110 ID from  compatibility list Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
    Re: [PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Thomas Hellstrom <thellstrom@vmware.com> - 2015-12-25 15:20 +0100
      Re: [PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Ben Hutchings <ben@decadent.org.uk> - 2015-12-26 05:40 +0100
  [PATCH 3.2 66/77] ipv6: sctp: implement sctp_v6_destroy_sock() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 06/77] USB: serial: option: add support for Novatel  MiFi USB620L Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 71/77] sh_eth: fix kernel oops in skb_put() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 14/77] mac80211: mesh: fix call_rcu() usage Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
  [PATCH 3.2 49/77] usb: xhci: fix config fail of FS hub behind a  HS hub with MTT Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 54/77] vgaarb: fix signal handling in vga_get() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 58/77] sh64: fix __NR_fgetxattr Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 70/77] net: add validation for the socket syscall  protocol  argument Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 40/77] wan/x25: Fix use-after-free in x25_asy_open_tty() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 44/77] ipv4: igmp: Allow removing groups from a  removed interface Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 03/77] ALSA: usb-audio: add packet size quirk for the  Medeli DD305 Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 53/77] dm btree: fix bufio buffer leaks in  dm_btree_del() error path Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 74/77] af_unix: Revert 'lock_interruptible' in stream  receive  code Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 47/77] sched/core: Remove false-positive warning from  wake_up_process() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 75/77] af_unix: fix a fatal race with bit fields Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 45/77] locking: Add WARN_ON_ONCE lock assertion Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 35/77] RDS: fix race condition when sending a message  on unbound socket Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 77/77] ppp, slip: Validate VJ compression slot  parameters completely Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 41/77] USB: whci-hcd: add check for dma mapping error Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 51/77] 9p: ->evict_inode() should kick out ->i_data,  not ->i_mapping Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 38/77] AHCI: Fix softreset failed issue of Port Multiplier Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 39/77] sata_sil: disable trim Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  [PATCH 3.2 36/77] nfs: if we have no valid attrs, then don't  declare the attribute cache valid Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
  Re: [PATCH 3.2 00/77] 3.2.75-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-12-24 23:30 +0100
    Re: [PATCH 3.2 00/77] 3.2.75-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 23:40 +0100

csiph-web