[PATCH 1/1] neighbour: Fixed race condition at tbl->nht

[PATCH 1/1] neighbour: Fixed race condition at tbl->nht

[Michel Machado]

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado <michel@digirati.com.br>
CC: "David S. Miller" <davem@davemloft.net>
CC: Eric Dumazet <eric.dumazet@gmail.com>
---

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e287346..2a83914 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -826,6 +826,8 @@ next_elt:
 		write_unlock_bh(&tbl->lock);
 		cond_resched();
 		write_lock_bh(&tbl->lock);
+		nht = rcu_dereference_protected(tbl->nht,
+						lockdep_is_held(&tbl->lock));
 	}
 	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
 	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2

Re: [PATCH 1/1] neighbour: Fixed race condition at tbl->nht

[Eric Dumazet]

Le mardi 21 février 2012 à 16:04 -0500, Michel Machado a écrit :
> When the fixed race condition happens:
> 
> 1. While function neigh_periodic_work scans the neighbor hash table
> pointed by field tbl->nht, it unlocks and locks tbl->lock between
> buckets in order to call cond_resched.
> 
> 2. Assume that function neigh_periodic_work calls cond_resched, that is,
> the lock tbl->lock is available, and function neigh_hash_grow runs.
> 
> 3. Once function neigh_hash_grow finishes, and RCU calls
> neigh_hash_free_rcu, the original struct neigh_hash_table that function
> neigh_periodic_work was using doesn't exist anymore.
> 
> 4. Once back at neigh_periodic_work, whenever the old struct
> neigh_hash_table is accessed, things can go badly.
> 
> Signed-off-by: Michel Machado <michel@digirati.com.br>
> CC: "David S. Miller" <davem@davemloft.net>
> CC: Eric Dumazet <eric.dumazet@gmail.com>
> ---
> 
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index e287346..2a83914 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -826,6 +826,8 @@ next_elt:
>  		write_unlock_bh(&tbl->lock);
>  		cond_resched();
>  		write_lock_bh(&tbl->lock);
> +		nht = rcu_dereference_protected(tbl->nht,
> +						lockdep_is_held(&tbl->lock));
>  	}
>  	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
>  	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
> 

Nice catch !

Bug introduced in 2.6.37 in commit d6bf781712a (net neigh: RCU
conversion of neigh hash table)

Acked-by: Eric Dumazet <eric.dumazet@gmail.com>

Re: [PATCH 1/1] neighbour: Fixed race condition at tbl->nht

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 21 Feb 2012 22:25:22 +0100

> Le mardi 21 février 2012 à 16:04 -0500, Michel Machado a écrit :
>> When the fixed race condition happens:
>> 
>> 1. While function neigh_periodic_work scans the neighbor hash table
>> pointed by field tbl->nht, it unlocks and locks tbl->lock between
>> buckets in order to call cond_resched.
>> 
>> 2. Assume that function neigh_periodic_work calls cond_resched, that is,
>> the lock tbl->lock is available, and function neigh_hash_grow runs.
>> 
>> 3. Once function neigh_hash_grow finishes, and RCU calls
>> neigh_hash_free_rcu, the original struct neigh_hash_table that function
>> neigh_periodic_work was using doesn't exist anymore.
>> 
>> 4. Once back at neigh_periodic_work, whenever the old struct
>> neigh_hash_table is accessed, things can go badly.
>> 
>> Signed-off-by: Michel Machado <michel@digirati.com.br>
 ...
> Nice catch !
> 
> Bug introduced in 2.6.37 in commit d6bf781712a (net neigh: RCU
> conversion of neigh hash table)
> 
> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>

Applied, and queued up for -stable, thanks.