• Jason A. Donenfeld's avatar
    wireguard: peerlookup: take lock before checking hash in replace operation · 6147f7b1
    Jason A. Donenfeld authored
    Eric's suggested fix for the previous commit's mentioned race condition
    was to simply take the table->lock in wg_index_hashtable_replace(). The
    table->lock of the hash table is supposed to protect the bucket heads,
    not the entires, but actually, since all the mutator functions are
    already taking it, it makes sense to take it too for the test to
    hlist_unhashed, as a defense in depth measure, so that it no longer
    races with deletions, regardless of what other locks are protecting
    individual entries. This is sensible from a performance perspective
    because, as Eric pointed out, the case of being unhashed is already the
    unlikely case, so this won't add common contention. And comparing
    instructions, this basically doesn't make much of a difference other
    than pushing and popping %r13, used by the new `bool ret`. More
    generally, I like the idea of locking consistency across table mutator
    functions, and this might let me rest slightly easier at night.
    Suggested-by: default avatarEric Dumazet <edumazet@google.com>
    Link: https://lore.kernel.org/wireguard/20200908145911.4090480-1-edumazet@google.com/
    Fixes: e7096c13 ("net: WireGuard secure network tunnel")
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6147f7b1
peerlookup.c 6.29 KB