* Re: [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() [not found] ` <20071017.212302.68039057.davem@davemloft.net> @ 2007-10-19 2:29 ` Olof Johansson 2007-10-19 4:55 ` David Miller 0 siblings, 1 reply; 4+ messages in thread From: Olof Johansson @ 2007-10-19 2:29 UTC (permalink / raw) To: David Miller; +Cc: xemul, netdev, devel, linux-kernel On Wed, Oct 17, 2007 at 09:23:02PM -0700, David Miller wrote: [...] > > The same problem exists for detaching filter (SO_DETACH_FILTER). > > > > The proposed fix consists of 3 preparation patches and the fix itself. > > > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > > Looks good, applied. > > Thanks for fixing this bug Pavel! Looks like this might be causing problems, at least for me on ppc. This happened during a normal boot, right around first interface config/dhcp run.. cpu 0x0: Vector: 300 (Data Access) at [c00000000147b820] pc: c000000000435e5c: .sk_filter_delayed_uncharge+0x1c/0x60 lr: c0000000004360d0: .sk_attach_filter+0x170/0x180 sp: c00000000147baa0 msr: 9000000000009032 dar: 4 dsisr: 40000000 current = 0xc000000004780fa0 paca = 0xc000000000650480 pid = 1295, comm = dhclient3 0:mon> t [c00000000147bb20] c0000000004360d0 .sk_attach_filter+0x170/0x180 [c00000000147bbd0] c000000000418988 .sock_setsockopt+0x788/0x7f0 [c00000000147bcb0] c000000000438a74 .compat_sys_setsockopt+0x4e4/0x5a0 [c00000000147bd90] c00000000043955c .compat_sys_socketcall+0x25c/0x2b0 [c00000000147be30] c000000000007508 syscall_exit+0x0/0x40 --- Exception: c01 (System Call) at 000000000ff618d8 SP (fffdf040) is in userspace 0:mon> I.e. null pointer deref at sk_filter_delayed_uncharge+0x1c: 0:mon> di $.sk_filter_delayed_uncharge c000000000435e40 7c0802a6 mflr r0 c000000000435e44 fbc1fff0 std r30,-16(r1) c000000000435e48 7c8b2378 mr r11,r4 c000000000435e4c ebc2cdd0 ld r30,-12848(r2) c000000000435e50 f8010010 std r0,16(r1) c000000000435e54 f821ff81 stdu r1,-128(r1) c000000000435e58 380300a4 addi r0,r3,164 c000000000435e5c 81240004 lwz r9,4(r4) That's the deref of fp: static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp) { unsigned int size = sk_filter_len(fp); ... That is called from sk_attach_filter(): ... rcu_read_lock_bh(); old_fp = rcu_dereference(sk->sk_filter); rcu_assign_pointer(sk->sk_filter, fp); rcu_read_unlock_bh(); sk_filter_delayed_uncharge(sk, old_fp); return 0; ... So, looks like rcu_dereference() returned NULL. I don't know the filter code at all, but it seems like it might be a valid case? sk_detach_filter() seems to handle a NULL sk_filter, at least. So, this needs review by someone who knows the filter, but it fixes the problem for me: Signed-off-by: Olof Johansson <olof@lixom.net> diff --git a/net/core/filter.c b/net/core/filter.c index 1f0068e..e0a0694 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -447,7 +447,8 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) rcu_assign_pointer(sk->sk_filter, fp); rcu_read_unlock_bh(); - sk_filter_delayed_uncharge(sk, old_fp); + if (old_fp) + sk_filter_delayed_uncharge(sk, old_fp); return 0; } ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() 2007-10-19 2:29 ` [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() Olof Johansson @ 2007-10-19 4:55 ` David Miller 2007-10-19 7:37 ` Pavel Emelyanov 0 siblings, 1 reply; 4+ messages in thread From: David Miller @ 2007-10-19 4:55 UTC (permalink / raw) To: olof; +Cc: xemul, netdev, devel, linux-kernel From: Olof Johansson <olof@lixom.net> Date: Thu, 18 Oct 2007 21:29:47 -0500 > So, looks like rcu_dereference() returned NULL. I don't know the > filter code at all, but it seems like it might be a valid case? > sk_detach_filter() seems to handle a NULL sk_filter, at least. > > > So, this needs review by someone who knows the filter, but it fixes the > problem for me: > > > Signed-off-by: Olof Johansson <olof@lixom.net> I've applied this for now to my net-2.6 tree, thanks Olof for tracking this down. Pavel please take a look at this and let me know if it should fixed in some other way. Thanks! ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() 2007-10-19 4:55 ` David Miller @ 2007-10-19 7:37 ` Pavel Emelyanov 2007-10-19 7:52 ` David Miller 0 siblings, 1 reply; 4+ messages in thread From: Pavel Emelyanov @ 2007-10-19 7:37 UTC (permalink / raw) To: David Miller, olof; +Cc: netdev, devel, linux-kernel David Miller wrote: > From: Olof Johansson <olof@lixom.net> > Date: Thu, 18 Oct 2007 21:29:47 -0500 > >> So, looks like rcu_dereference() returned NULL. I don't know the >> filter code at all, but it seems like it might be a valid case? >> sk_detach_filter() seems to handle a NULL sk_filter, at least. >> >> >> So, this needs review by someone who knows the filter, but it fixes the >> problem for me: Yes. The NULL filter is a valid case, when there are no filters attached at all. So this fix is correct. Thanks, Olof. Sorry, Dave :( >> >> Signed-off-by: Olof Johansson <olof@lixom.net> Acked-by: Pavel Emelyanov <xemul@openvz.org> > I've applied this for now to my net-2.6 tree, thanks Olof > for tracking this down. > > Pavel please take a look at this and let me know if it should > fixed in some other way. > > Thanks! > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() 2007-10-19 7:37 ` Pavel Emelyanov @ 2007-10-19 7:52 ` David Miller 0 siblings, 0 replies; 4+ messages in thread From: David Miller @ 2007-10-19 7:52 UTC (permalink / raw) To: xemul; +Cc: olof, netdev, devel, linux-kernel From: Pavel Emelyanov <xemul@openvz.org> Date: Fri, 19 Oct 2007 11:37:02 +0400 > David Miller wrote: > > From: Olof Johansson <olof@lixom.net> > > Date: Thu, 18 Oct 2007 21:29:47 -0500 > > > >> So, looks like rcu_dereference() returned NULL. I don't know the > >> filter code at all, but it seems like it might be a valid case? > >> sk_detach_filter() seems to handle a NULL sk_filter, at least. > >> > >> > >> So, this needs review by someone who knows the filter, but it fixes the > >> problem for me: > > Yes. The NULL filter is a valid case, when there are no > filters attached at all. So this fix is correct. > > Thanks, Olof. Sorry, Dave :( No worries, thanks for reviewing. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-10-19 7:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <4715D9D2.8070102@openvz.org>
[not found] ` <20071017.212302.68039057.davem@davemloft.net>
2007-10-19 2:29 ` [PATCH 0/4] Fix race between sk_filter reassign and sk_clone() Olof Johansson
2007-10-19 4:55 ` David Miller
2007-10-19 7:37 ` Pavel Emelyanov
2007-10-19 7:52 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox