Commit 6e8fcbf6 authored by Alexey Kuznetsov's avatar Alexey Kuznetsov Committed by David S. Miller

[IPV4]: severe locking bug in fib_semantics.c

Found in 2.4 by Yixin Pan <yxpan@hotmail.com>.

> When I read fib_semantics.c of Linux-2.4.32, write_lock(&fib_info_lock) =
> is used in fib_release_info() instead of write_lock_bh(&fib_info_lock).  =
> Is the following case possible: a BH interrupts fib_release_info() while =
> holding the write lock, and calls ip_check_fib_default() which calls =
> read_lock(&fib_info_lock), and spin forever.
Signed-off-by: default avatarAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent acd6e00b
...@@ -159,7 +159,7 @@ void free_fib_info(struct fib_info *fi) ...@@ -159,7 +159,7 @@ void free_fib_info(struct fib_info *fi)
void fib_release_info(struct fib_info *fi) void fib_release_info(struct fib_info *fi)
{ {
write_lock(&fib_info_lock); write_lock_bh(&fib_info_lock);
if (fi && --fi->fib_treeref == 0) { if (fi && --fi->fib_treeref == 0) {
hlist_del(&fi->fib_hash); hlist_del(&fi->fib_hash);
if (fi->fib_prefsrc) if (fi->fib_prefsrc)
...@@ -172,7 +172,7 @@ void fib_release_info(struct fib_info *fi) ...@@ -172,7 +172,7 @@ void fib_release_info(struct fib_info *fi)
fi->fib_dead = 1; fi->fib_dead = 1;
fib_info_put(fi); fib_info_put(fi);
} }
write_unlock(&fib_info_lock); write_unlock_bh(&fib_info_lock);
} }
static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi) static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi)
...@@ -598,7 +598,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash, ...@@ -598,7 +598,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
unsigned int old_size = fib_hash_size; unsigned int old_size = fib_hash_size;
unsigned int i, bytes; unsigned int i, bytes;
write_lock(&fib_info_lock); write_lock_bh(&fib_info_lock);
old_info_hash = fib_info_hash; old_info_hash = fib_info_hash;
old_laddrhash = fib_info_laddrhash; old_laddrhash = fib_info_laddrhash;
fib_hash_size = new_size; fib_hash_size = new_size;
...@@ -639,7 +639,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash, ...@@ -639,7 +639,7 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
} }
fib_info_laddrhash = new_laddrhash; fib_info_laddrhash = new_laddrhash;
write_unlock(&fib_info_lock); write_unlock_bh(&fib_info_lock);
bytes = old_size * sizeof(struct hlist_head *); bytes = old_size * sizeof(struct hlist_head *);
fib_hash_free(old_info_hash, bytes); fib_hash_free(old_info_hash, bytes);
...@@ -820,7 +820,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta, ...@@ -820,7 +820,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta,
fi->fib_treeref++; fi->fib_treeref++;
atomic_inc(&fi->fib_clntref); atomic_inc(&fi->fib_clntref);
write_lock(&fib_info_lock); write_lock_bh(&fib_info_lock);
hlist_add_head(&fi->fib_hash, hlist_add_head(&fi->fib_hash,
&fib_info_hash[fib_info_hashfn(fi)]); &fib_info_hash[fib_info_hashfn(fi)]);
if (fi->fib_prefsrc) { if (fi->fib_prefsrc) {
...@@ -839,7 +839,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta, ...@@ -839,7 +839,7 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta,
head = &fib_info_devhash[hash]; head = &fib_info_devhash[hash];
hlist_add_head(&nh->nh_hash, head); hlist_add_head(&nh->nh_hash, head);
} endfor_nexthops(fi) } endfor_nexthops(fi)
write_unlock(&fib_info_lock); write_unlock_bh(&fib_info_lock);
return fi; return fi;
err_inval: err_inval:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment