FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2025-04-03 08:22:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ipv6: fix rtnl locking in setsockopt for anycast and multicast

Browse Source 
Calling setsockopt with IPV6_JOIN_ANYCAST or IPV6_LEAVE_ANYCAST
triggers the assertion in addrconf_join_solict()/addrconf_leave_solict()

ipv6_sock_ac_join(), ipv6_sock_ac_drop(), ipv6_sock_ac_close() need to
take RTNL before calling ipv6_dev_ac_inc/dec. Same thing with
ipv6_sock_mc_join(), ipv6_sock_mc_drop(), ipv6_sock_mc_close() before
calling ipv6_dev_mc_inc/dec.

This patch moves ASSERT_RTNL() up a level in the call stack.

Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Sabrina Dubroca 2014-09-02 10:29:29 +02:00 committed by David S. Miller
parent 4ad9a64f53
commit a9ed4a2986
3 changed files with 31 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/ipv6/addrconf.c
View File

@ -1690,14 +1690,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
addrconf_mod_dad_work(ifp, 0); addrconf_mod_dad_work(ifp, 0);
} }
/* Join to solicited addr multicast group. */ /* Join to solicited addr multicast group.
* caller must hold RTNL */
void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr) void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
{ {
struct in6_addr maddr; struct in6_addr maddr;
ASSERT_RTNL();
if (dev->flags&(IFF_LOOPBACK|IFF_NOARP)) if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
return; return;
@ -1705,12 +1703,11 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
ipv6_dev_mc_inc(dev, &maddr); ipv6_dev_mc_inc(dev, &maddr);
} }
/* caller must hold RTNL */
void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr) void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
{ {
struct in6_addr maddr; struct in6_addr maddr;
ASSERT_RTNL();
if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP)) if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
return; return;
@ -1718,12 +1715,11 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
__ipv6_dev_mc_dec(idev, &maddr); __ipv6_dev_mc_dec(idev, &maddr);
} }
/* caller must hold RTNL */
static void addrconf_join_anycast(struct inet6_ifaddr *ifp) static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
{ {
struct in6_addr addr; struct in6_addr addr;
ASSERT_RTNL();
if (ifp->prefix_len >= 127) /* RFC 6164 */ if (ifp->prefix_len >= 127) /* RFC 6164 */
return; return;
ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len); ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@ -1732,12 +1728,11 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
ipv6_dev_ac_inc(ifp->idev->dev, &addr); ipv6_dev_ac_inc(ifp->idev->dev, &addr);
} }
/* caller must hold RTNL */
static void addrconf_leave_anycast(struct inet6_ifaddr *ifp) static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
{ {
struct in6_addr addr; struct in6_addr addr;
ASSERT_RTNL();
if (ifp->prefix_len >= 127) /* RFC 6164 */ if (ifp->prefix_len >= 127) /* RFC 6164 */
return; return;
ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len); ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);

12
net/ipv6/anycast.c
View File

@ -77,6 +77,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
pac->acl_next = NULL; pac->acl_next = NULL;
pac->acl_addr = *addr; pac->acl_addr = *addr;
rtnl_lock();
rcu_read_lock(); rcu_read_lock();
if (ifindex == 0) { if (ifindex == 0) {
struct rt6_info *rt; struct rt6_info *rt;
@ -137,6 +138,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
error: error:
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
if (pac) if (pac)
sock_kfree_s(sk, pac, sizeof(*pac)); sock_kfree_s(sk, pac, sizeof(*pac));
return err; return err;
@ -171,13 +173,17 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
spin_unlock_bh(&ipv6_sk_ac_lock); spin_unlock_bh(&ipv6_sk_ac_lock);
rtnl_lock();
rcu_read_lock(); rcu_read_lock();
dev = dev_get_by_index_rcu(net, pac->acl_ifindex); dev = dev_get_by_index_rcu(net, pac->acl_ifindex);
if (dev) if (dev)
ipv6_dev_ac_dec(dev, &pac->acl_addr); ipv6_dev_ac_dec(dev, &pac->acl_addr);
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
sock_kfree_s(sk, pac, sizeof(*pac)); sock_kfree_s(sk, pac, sizeof(*pac));
if (!dev)
return -ENODEV;
return 0; return 0;
} }
@ -198,6 +204,7 @@ void ipv6_sock_ac_close(struct sock *sk)
spin_unlock_bh(&ipv6_sk_ac_lock); spin_unlock_bh(&ipv6_sk_ac_lock);
prev_index = 0; prev_index = 0;
rtnl_lock();
rcu_read_lock(); rcu_read_lock();
while (pac) { while (pac) {
struct ipv6_ac_socklist *next = pac->acl_next; struct ipv6_ac_socklist *next = pac->acl_next;
@ -212,6 +219,7 @@ void ipv6_sock_ac_close(struct sock *sk)
pac = next; pac = next;
} }
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
} }
static void aca_put(struct ifacaddr6 *ac) static void aca_put(struct ifacaddr6 *ac)
@ -233,6 +241,8 @@ int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr)
struct rt6_info *rt; struct rt6_info *rt;
int err; int err;
ASSERT_RTNL();
idev = in6_dev_get(dev); idev = in6_dev_get(dev);
if (idev == NULL) if (idev == NULL)
@ -302,6 +312,8 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
{ {
struct ifacaddr6 *aca, *prev_aca; struct ifacaddr6 *aca, *prev_aca;
ASSERT_RTNL();
write_lock_bh(&idev->lock); write_lock_bh(&idev->lock);
prev_aca = NULL; prev_aca = NULL;
for (aca = idev->ac_list; aca; aca = aca->aca_next) { for (aca = idev->ac_list; aca; aca = aca->aca_next) {

14
net/ipv6/mcast.c
View File

@ -172,6 +172,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
mc_lst->next = NULL; mc_lst->next = NULL;
mc_lst->addr = *addr; mc_lst->addr = *addr;
rtnl_lock();
rcu_read_lock(); rcu_read_lock();
if (ifindex == 0) { if (ifindex == 0) {
struct rt6_info *rt; struct rt6_info *rt;
@ -185,6 +186,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
if (dev == NULL) { if (dev == NULL) {
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
sock_kfree_s(sk, mc_lst, sizeof(*mc_lst)); sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
return -ENODEV; return -ENODEV;
} }
@ -202,6 +204,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
if (err) { if (err) {
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
sock_kfree_s(sk, mc_lst, sizeof(*mc_lst)); sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
return err; return err;
} }
@ -212,6 +215,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
spin_unlock(&ipv6_sk_mc_lock); spin_unlock(&ipv6_sk_mc_lock);
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
return 0; return 0;
} }
@ -229,6 +233,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
if (!ipv6_addr_is_multicast(addr)) if (!ipv6_addr_is_multicast(addr))
return -EINVAL; return -EINVAL;
rtnl_lock();
spin_lock(&ipv6_sk_mc_lock); spin_lock(&ipv6_sk_mc_lock);
for (lnk = &np->ipv6_mc_list; for (lnk = &np->ipv6_mc_list;
(mc_lst = rcu_dereference_protected(*lnk, (mc_lst = rcu_dereference_protected(*lnk,
@ -252,12 +257,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
} else } else
(void) ip6_mc_leave_src(sk, mc_lst, NULL); (void) ip6_mc_leave_src(sk, mc_lst, NULL);
rcu_read_unlock(); rcu_read_unlock();
rtnl_unlock();
atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc); atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
kfree_rcu(mc_lst, rcu); kfree_rcu(mc_lst, rcu);
return 0; return 0;
} }
} }
spin_unlock(&ipv6_sk_mc_lock); spin_unlock(&ipv6_sk_mc_lock);
rtnl_unlock();
return -EADDRNOTAVAIL; return -EADDRNOTAVAIL;
} }
@ -302,6 +310,7 @@ void ipv6_sock_mc_close(struct sock *sk)
if (!rcu_access_pointer(np->ipv6_mc_list)) if (!rcu_access_pointer(np->ipv6_mc_list))
return; return;
rtnl_lock();
spin_lock(&ipv6_sk_mc_lock); spin_lock(&ipv6_sk_mc_lock);
while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list, while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) { lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
@ -328,6 +337,7 @@ void ipv6_sock_mc_close(struct sock *sk)
spin_lock(&ipv6_sk_mc_lock); spin_lock(&ipv6_sk_mc_lock);
} }
spin_unlock(&ipv6_sk_mc_lock); spin_unlock(&ipv6_sk_mc_lock);
rtnl_unlock();
} }
int ip6_mc_source(int add, int omode, struct sock *sk, int ip6_mc_source(int add, int omode, struct sock *sk,
@ -845,6 +855,8 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
struct ifmcaddr6 *mc; struct ifmcaddr6 *mc;
struct inet6_dev *idev; struct inet6_dev *idev;
ASSERT_RTNL();
/* we need to take a reference on idev */ /* we need to take a reference on idev */
idev = in6_dev_get(dev); idev = in6_dev_get(dev);
@ -916,6 +928,8 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
{ {
struct ifmcaddr6 *ma, **map; struct ifmcaddr6 *ma, **map;
ASSERT_RTNL();
write_lock_bh(&idev->lock); write_lock_bh(&idev->lock);
for (map = &idev->mc_list; (ma=*map) != NULL; map = &ma->next) { for (map = &idev->mc_list; (ma=*map) != NULL; map = &ma->next) {
if (ipv6_addr_equal(&ma->mca_addr, addr)) { if (ipv6_addr_equal(&ma->mca_addr, addr)) {