Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Fix double fetch in RCU version of hlist_*entry*

[Marek Lindner <mareklindner@neomailbox.ch>]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

On Monday 03 November 2014 23:16:19 Sven Eckelmann wrote:
> The backported (<3.9) version of hlist_for_each_entry_rcu and
> hlist_for_each_entry_safe uses the new macro hlist_entry_safe. It is called
> with an ACCESS_ONCE parameter for the first parameter ptr. This disallows
> merging of the two loads which the current version of the macro uses.
> 
> This is problematic because this macro must only generate one load.
> Otherwise with two contexts (or CPUs) following could happen:
> 
> 1. context 1 fetches the ptr to the last entry in hlist_entry_safe() and
>    accepts this non-NULL ptr
> 
> 2. context 2 deletes the last entry and terminates the list with NULL
> 
> 3. context 1 re-fetches the pointer, doesn't check for zero, calculates the
>    entry based on a NULL pointer
> 
> 4. context 1 crashes because it tries to load/write data from/to the invalid
> address
> 
> Instead use a single load to a temporary variable and do the NULL-check and
> calculation based on that one.
> 
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
>  compat.h | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Great find! Applied in revision 1e4a96a.

Thanks,
Marek

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]