Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1735502
| From | "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH review for 4.4 37/47] netfilter: invoke synchronize_rcu after set the _hook_ to NULL |
| Date | 2017-09-20 07:10 +0200 |
| Message-ID | <urFqN-6Vo-3@gated-at.bofh.it> (permalink) |
| References | <urF7r-6xD-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Liping Zhang <zlpnobody@gmail.com>
[ Upstream commit 3b7dabf029478bb80507a6c4500ca94132a2bc0b ]
Otherwise, another CPU may access the invalid pointer. For example:
CPU0 CPU1
- rcu_read_lock();
- pfunc = _hook_;
_hook_ = NULL; -
mod unload -
- pfunc(); // invalid, panic
- rcu_read_unlock();
So we must call synchronize_rcu() to wait the rcu reader to finish.
Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.
Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
net/ipv4/netfilter/nf_nat_snmp_basic.c | 1 +
net/netfilter/nf_conntrack_ecache.c | 2 ++
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_nat_core.c | 2 ++
net/netfilter/nfnetlink_cttimeout.c | 2 +-
5 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index ddb894ac1458..2689c9c4f1a0 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
static void __exit nf_nat_snmp_basic_fini(void)
{
RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+ synchronize_rcu();
nf_conntrack_helper_unregister(&snmp_trap_helper);
}
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 4e78c57b818f..f3b92ce463b0 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -200,6 +200,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
mutex_unlock(&nf_ct_ecache_mutex);
+ /* synchronize_rcu() is called from ctnetlink_exit. */
}
EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
@@ -236,6 +237,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
BUG_ON(notify != new);
RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
mutex_unlock(&nf_ct_ecache_mutex);
+ /* synchronize_rcu() is called from ctnetlink_exit. */
}
EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index e565b2becb14..660939df7c94 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3415,6 +3415,7 @@ static void __exit ctnetlink_exit(void)
#ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
RCU_INIT_POINTER(nfnl_ct_hook, NULL);
#endif
+ synchronize_rcu();
}
module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 06a9f45771ab..44516c90118a 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -892,6 +892,8 @@ static void __exit nf_nat_cleanup(void)
#ifdef CONFIG_XFRM
RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
#endif
+ synchronize_rcu();
+
for (i = 0; i < NFPROTO_NUMPROTO; i++)
kfree(nf_nat_l4protos[i]);
synchronize_net();
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index c7a2d0e1c462..ed9153bd7e73 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -611,8 +611,8 @@ static void __exit cttimeout_exit(void)
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+ synchronize_rcu();
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
- rcu_barrier();
}
module_init(cttimeout_init);
--
2.11.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH review for 4.4 01/47] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after free_netdev "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 35/47] mmc: sdio: fix alignment issue in struct sdio_func "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 37/47] netfilter: invoke synchronize_rcu after set the _hook_ to NULL "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 11/47] sh_eth: use correct name for ECMR_MPDE bit "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 21/47] drm/amdkfd: fix improper return value on error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in GPT size calculation "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 15/47] iio: adc: hx711: Add DT binding for avia,hx711 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 22/47] USB: serial: mos7720: fix control-message error handling "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 14/47] iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 08/47] MIPS: ralink: Fix incorrect assignment on ralink_soc "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 04/47] RDS: RDMA: Fix the composite message user notification "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad range Charles Keepax <ckeepax@opensource.cirrus.com> - 2017-09-22 10:50 +0200
Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-24 02:20 +0200
[PATCH review for 4.4 02/47] drm: bridge: add DT bindings for TI ths8135 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 28/47] usb: chipidea: vbus event may exist before starting gadget "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 13/47] hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 40/47] netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 05/47] ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
[PATCH review for 4.4 18/47] IB/ipoib: Fix deadlock over vlan_mutex "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
csiph-web