* [PATCH] netfilter: fix a race in nf_ct_ext_create()
@ 2010-08-31 15:48 Eric Dumazet
2010-08-31 15:51 ` Paul E. McKenney
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2010-08-31 15:48 UTC (permalink / raw)
To: David Miller
Cc: Patrick McHardy, netdev, Netfilter Development Mailinglist,
Paul E. McKenney
As soon as rcu_read_unlock() is called, there is no guarantee current
thread can safely derefence t pointer, rcu protected.
Fix is to copy t->alloc_size in a temporary variable.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
net/netfilter/nf_conntrack_extend.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 7dcf7a4..8d9e4c9 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -48,15 +48,17 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
{
unsigned int off, len;
struct nf_ct_ext_type *t;
+ size_t alloc_size;
rcu_read_lock();
t = rcu_dereference(nf_ct_ext_types[id]);
BUG_ON(t == NULL);
off = ALIGN(sizeof(struct nf_ct_ext), t->align);
len = off + t->len;
+ alloc_size = t->alloc_size;
rcu_read_unlock();
- *ext = kzalloc(t->alloc_size, gfp);
+ *ext = kzalloc(alloc_size, gfp);
if (!*ext)
return NULL;
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] netfilter: fix a race in nf_ct_ext_create()
2010-08-31 15:48 [PATCH] netfilter: fix a race in nf_ct_ext_create() Eric Dumazet
@ 2010-08-31 15:51 ` Paul E. McKenney
2010-09-16 18:00 ` Patrick McHardy
0 siblings, 1 reply; 3+ messages in thread
From: Paul E. McKenney @ 2010-08-31 15:51 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, Patrick McHardy, netdev,
Netfilter Development Mailinglist
On Tue, Aug 31, 2010 at 05:48:02PM +0200, Eric Dumazet wrote:
> As soon as rcu_read_unlock() is called, there is no guarantee current
> thread can safely derefence t pointer, rcu protected.
>
> Fix is to copy t->alloc_size in a temporary variable.
Yow!!! Good catch!!!
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> ---
> net/netfilter/nf_conntrack_extend.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
> index 7dcf7a4..8d9e4c9 100644
> --- a/net/netfilter/nf_conntrack_extend.c
> +++ b/net/netfilter/nf_conntrack_extend.c
> @@ -48,15 +48,17 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
> {
> unsigned int off, len;
> struct nf_ct_ext_type *t;
> + size_t alloc_size;
>
> rcu_read_lock();
> t = rcu_dereference(nf_ct_ext_types[id]);
> BUG_ON(t == NULL);
> off = ALIGN(sizeof(struct nf_ct_ext), t->align);
> len = off + t->len;
> + alloc_size = t->alloc_size;
> rcu_read_unlock();
>
> - *ext = kzalloc(t->alloc_size, gfp);
> + *ext = kzalloc(alloc_size, gfp);
> if (!*ext)
> return NULL;
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] netfilter: fix a race in nf_ct_ext_create()
2010-08-31 15:51 ` Paul E. McKenney
@ 2010-09-16 18:00 ` Patrick McHardy
0 siblings, 0 replies; 3+ messages in thread
From: Patrick McHardy @ 2010-09-16 18:00 UTC (permalink / raw)
To: paulmck
Cc: Eric Dumazet, David Miller, netdev,
Netfilter Development Mailinglist
On 31.08.2010 17:51, Paul E. McKenney wrote:
> On Tue, Aug 31, 2010 at 05:48:02PM +0200, Eric Dumazet wrote:
>> > As soon as rcu_read_unlock() is called, there is no guarantee current
>> > thread can safely derefence t pointer, rcu protected.
>> >
>> > Fix is to copy t->alloc_size in a temporary variable.
> Yow!!! Good catch!!!
>
> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
>
>> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-09-16 18:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-08-31 15:48 [PATCH] netfilter: fix a race in nf_ct_ext_create() Eric Dumazet
2010-08-31 15:51 ` Paul E. McKenney
2010-09-16 18:00 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).