Commit 1748f6a2 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

rhashtable: Fix unprotected RCU dereference in __rht_ptr

The rcu_dereference call in rht_ptr_rcu is completely bogus because
we've already dereferenced the value in __rht_ptr and operated on it.
This causes potential double readings which could be fatal.  The RCU
dereference must occur prior to the comparison in __rht_ptr.

This patch changes the order of RCU dereference so that it is done
first and the result is then fed to __rht_ptr.  The RCU marking
changes have been minimised using casts which will be removed in
a follow-up patch.

Fixes: ba6306e3 ("rhashtable: Remove RCU marking from...")
Reported-by: default avatar"Gong, Sishuai" <sishuai@purdue.edu>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 19016d93
...@@ -349,11 +349,11 @@ static inline void rht_unlock(struct bucket_table *tbl, ...@@ -349,11 +349,11 @@ static inline void rht_unlock(struct bucket_table *tbl,
local_bh_enable(); local_bh_enable();
} }
static inline struct rhash_head __rcu *__rht_ptr( static inline struct rhash_head *__rht_ptr(
struct rhash_lock_head *const *bkt) struct rhash_lock_head *p, struct rhash_lock_head __rcu *const *bkt)
{ {
return (struct rhash_head __rcu *) return (struct rhash_head *)
((unsigned long)*bkt & ~BIT(0) ?: ((unsigned long)p & ~BIT(0) ?:
(unsigned long)RHT_NULLS_MARKER(bkt)); (unsigned long)RHT_NULLS_MARKER(bkt));
} }
...@@ -365,25 +365,26 @@ static inline struct rhash_head __rcu *__rht_ptr( ...@@ -365,25 +365,26 @@ static inline struct rhash_head __rcu *__rht_ptr(
* access is guaranteed, such as when destroying the table. * access is guaranteed, such as when destroying the table.
*/ */
static inline struct rhash_head *rht_ptr_rcu( static inline struct rhash_head *rht_ptr_rcu(
struct rhash_lock_head *const *bkt) struct rhash_lock_head *const *p)
{ {
struct rhash_head __rcu *p = __rht_ptr(bkt); struct rhash_lock_head __rcu *const *bkt = (void *)p;
return __rht_ptr(rcu_dereference(*bkt), bkt);
return rcu_dereference(p);
} }
static inline struct rhash_head *rht_ptr( static inline struct rhash_head *rht_ptr(
struct rhash_lock_head *const *bkt, struct rhash_lock_head *const *p,
struct bucket_table *tbl, struct bucket_table *tbl,
unsigned int hash) unsigned int hash)
{ {
return rht_dereference_bucket(__rht_ptr(bkt), tbl, hash); struct rhash_lock_head __rcu *const *bkt = (void *)p;
return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
} }
static inline struct rhash_head *rht_ptr_exclusive( static inline struct rhash_head *rht_ptr_exclusive(
struct rhash_lock_head *const *bkt) struct rhash_lock_head *const *p)
{ {
return rcu_dereference_protected(__rht_ptr(bkt), 1); struct rhash_lock_head __rcu *const *bkt = (void *)p;
return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
} }
static inline void rht_assign_locked(struct rhash_lock_head **bkt, static inline void rht_assign_locked(struct rhash_lock_head **bkt,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment