* Query regarding a code snippet in __inet_lookup_established.
@ 2012-01-21 1:02 MuraliRaja Muniraju
2012-01-21 7:30 ` Eric Dumazet
0 siblings, 1 reply; 2+ messages in thread
From: MuraliRaja Muniraju @ 2012-01-21 1:02 UTC (permalink / raw)
To: netdev
Hi All,
In function __inet_lookup_established, I do see a potential issue
in a corner case while reading through the code where socket can be
freed while being in the list and also while in rcu_read critical
section.
rcu_read_lock();
begin:
sk_nulls_for_each_rcu(sk, node, &head->chain) {
if (INET_MATCH(sk, net, hash, acookie,
saddr, daddr, ports, dif)) {
if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
goto begintw;
if (unlikely(!INET_MATCH(sk, net, hash, acookie,
saddr, daddr, ports, dif))) {
Murali> sock_put(sk);
Murali> goto begin;
}
goto out;
}
}
I am not certain under what scenario this might occur. Can someone let
me know if this is a possibility.
--
Thanks,
Murali
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: Query regarding a code snippet in __inet_lookup_established.
2012-01-21 1:02 Query regarding a code snippet in __inet_lookup_established MuraliRaja Muniraju
@ 2012-01-21 7:30 ` Eric Dumazet
0 siblings, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2012-01-21 7:30 UTC (permalink / raw)
To: MuraliRaja Muniraju; +Cc: netdev
Le vendredi 20 janvier 2012 à 17:02 -0800, MuraliRaja Muniraju a écrit :
> Hi All,
> In function __inet_lookup_established, I do see a potential issue
> in a corner case while reading through the code where socket can be
> freed while being in the list and also while in rcu_read critical
> section.
> rcu_read_lock();
> begin:
> sk_nulls_for_each_rcu(sk, node, &head->chain) {
> if (INET_MATCH(sk, net, hash, acookie,
> saddr, daddr, ports, dif)) {
> if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
> goto begintw;
> if (unlikely(!INET_MATCH(sk, net, hash, acookie,
> saddr, daddr, ports, dif))) {
> Murali> sock_put(sk);
> Murali> goto begin;
> }
> goto out;
> }
> }
>
> I am not certain under what scenario this might occur. Can someone let
> me know if this is a possibility.
Since we succeeded in atomic_inc_not_zero(&sk->sk_refcnt), socket cannot
be freed until our sock_put()
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-01-21 7:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-01-21 1:02 Query regarding a code snippet in __inet_lookup_established MuraliRaja Muniraju
2012-01-21 7:30 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox