[PATCH 3.4 036/125] mac80211: mesh: fix call_rcu() usage

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	lizf@kernel.org
Newsgroups	linux.kernel
Subject	[PATCH 3.4 036/125] mac80211: mesh: fix call_rcu() usage
Date	Wed, 12 Oct 2016 15:00:03 +0200
Message-ID	<srriz-4vs-45@gated-at.bofh.it> (permalink)
References	<srqZb-4nM-3@gated-at.bofh.it>
X-Original-To	stable@vger.kernel.org
X-Mailer	git-send-email 1.9.1
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	70
Organization	linux.* mail to news gateway
X-Original-Cc	linux-kernel@vger.kernel.org, Johannes Berg <johannes.berg@intel.com>, Zefan Li <lizefan@huawei.com>
X-Original-Date	Wed, 12 Oct 2016 20:32:32 +0800
X-Original-Message-ID	<1476275641-4697-36-git-send-email-lizf@kernel.org>
X-Original-References	<1476275600-4626-1-git-send-email-lizf@kernel.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1499596

Show key headers only | View raw

From: Johannes Berg <johannes.berg@intel.com>

3.4.113-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit c2e703a55245bfff3db53b1f7cbe59f1ee8a4339 upstream.

When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.

Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.

This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.

Fixes: eb2b9311fd00 ("mac80211: mesh path table implementation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 net/mac80211/mesh_pathtbl.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 49aaefd..7ed81ee 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -757,10 +757,8 @@ void mesh_plink_broken(struct sta_info *sta)
 static void mesh_path_node_reclaim(struct rcu_head *rp)
 {
 	struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
 
 	del_timer_sync(&node->mpath->timer);
-	atomic_dec(&sdata->u.mesh.mpaths);
 	kfree(node->mpath);
 	kfree(node);
 }
@@ -768,8 +766,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
 /* needs to be called with the corresponding hashwlock taken */
 static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
 {
-	struct mesh_path *mpath;
-	mpath = node->mpath;
+	struct mesh_path *mpath = node->mpath;
+	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+
 	spin_lock(&mpath->state_lock);
 	mpath->flags |= MESH_PATH_RESOLVING;
 	if (mpath->is_gate)
@@ -777,6 +776,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
 	hlist_del_rcu(&node->list);
 	call_rcu(&node->rcu, mesh_path_node_reclaim);
 	spin_unlock(&mpath->state_lock);
+	atomic_dec(&sdata->u.mesh.mpaths);
 	atomic_dec(&tbl->entries);
 }
 
-- 
1.9.1

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.4 036/125] mac80211: mesh: fix call_rcu() usage lizf@kernel.org - 2016-10-12 15:00 +0200

csiph-web