Re: [PATCH] Don't attach callback to a going-away netlink socket

Patrick McHardy wrote:
> Pavel Emelianov wrote:
>> From: Denis Lunev <[email protected]>
>>
>> There is a race between netlink_dump_start() and netlink_release()
>> that can lead to the situation when a netlink socket with non-zero
>> callback is freed.
> 
> 
> Can you describe the race in more detail please?
> 
> 

Here it is:

CPU1:                           CPU2
netlink_release():              netlink_dump_start():

                                sk = netlink_lookup(); /* OK */

netlink_remove();

spin_lock(&nlk->cb_lock);
if (nlk->cb) { /* false */
  ...
}
spin_unlock(&nlk->cb_lock);

                                spin_lock(&nlk->cb_lock);
                                if (nlk->cb) { /* false */
                                         ...
                                }
                                nlk->cb = cb;
                                spin_unlock(&nlk->cb_lock);
                                ...
sock_orphan(sk);
/*
 * proceed with releasing
 * the socket
 */

The proposal it to make sock_orphan before detaching the callback
in netlink_release() and to check for the sock to be SOCK_DEAD in
netlink_dump_start() before setting a new callback.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [PATCH] Don't attach callback to a going-away netlink socket
    • From: Patrick McHardy <[email protected]>

• References:
  • [PATCH] Don't attach callback to a going-away netlink socket
    • From: Pavel Emelianov <[email protected]>
  • Re: [PATCH] Don't attach callback to a going-away netlink socket
    • From: Patrick McHardy <[email protected]>

• Prev by Date: Re: [PATCH -mm] scheduler: fix the return of the first time_slice
• Next by Date: Re: [PATCH -mm] scheduler: fix the return of the first time_slice
• Previous by thread: Re: [PATCH] Don't attach callback to a going-away netlink socket
• Next by thread: Re: [PATCH] Don't attach callback to a going-away netlink socket
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]