diff options
author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-12-04 21:03:26 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-12-08 12:58:44 -0500 |
commit | 35d9b0c906ad92d32a0b8db5daa6fabfcc2f068d (patch) | |
tree | d9cdc72902f327ff377dd8bedfaeb0a8eead24a5 | |
parent | 75c1c82566f23dd539fb7ccbf57a1caa7ba82628 (diff) |
llc: fix a device refcount imbalance
Le dimanche 05 décembre 2010 à 12:23 +0100, Eric Dumazet a écrit :
> Le dimanche 05 décembre 2010 à 09:19 +0100, Eric Dumazet a écrit :
>
> > Hmm..
> >
> > If somebody can explain why RTNL is held in arp_ioctl() (and therefore
> > in arp_req_delete()), we might first remove RTNL use in arp_ioctl() so
> > that your patch can be applied.
> >
> > Right now it is not good, because RTNL wont be necessarly held when you
> > are going to call arp_invalidate() ?
>
> While doing this analysis, I found a refcount bug in llc, I'll send a
> patch for net-2.6
Oh well, of course I must first fix the bug in net-2.6, and wait David
pull the fix in net-next-2.6 before sending this rcu conversion.
Note: this patch should be sent to stable teams (2.6.34 and up)
[PATCH net-2.6] llc: fix a device refcount imbalance
commit abf9d537fea225 (llc: add support for SO_BINDTODEVICE) added one
refcount imbalance in llc_ui_bind(), because dev_getbyhwaddr() doesnt
take a reference on device, while dev_get_by_index() does.
Fix this using RCU locking. And since an RCU conversion will be done for
2.6.38 for dev_getbyhwaddr(), put the rcu_read_lock/unlock exactly at
their final place.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: stable@kernel.org
Cc: Octavian Purdila <opurdila@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/llc/af_llc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 582612998211..e35dbe55f520 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c | |||
@@ -317,8 +317,9 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) | |||
317 | goto out; | 317 | goto out; |
318 | rc = -ENODEV; | 318 | rc = -ENODEV; |
319 | rtnl_lock(); | 319 | rtnl_lock(); |
320 | rcu_read_lock(); | ||
320 | if (sk->sk_bound_dev_if) { | 321 | if (sk->sk_bound_dev_if) { |
321 | llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); | 322 | llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); |
322 | if (llc->dev) { | 323 | if (llc->dev) { |
323 | if (!addr->sllc_arphrd) | 324 | if (!addr->sllc_arphrd) |
324 | addr->sllc_arphrd = llc->dev->type; | 325 | addr->sllc_arphrd = llc->dev->type; |
@@ -329,13 +330,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) | |||
329 | !llc_mac_match(addr->sllc_mac, | 330 | !llc_mac_match(addr->sllc_mac, |
330 | llc->dev->dev_addr)) { | 331 | llc->dev->dev_addr)) { |
331 | rc = -EINVAL; | 332 | rc = -EINVAL; |
332 | dev_put(llc->dev); | ||
333 | llc->dev = NULL; | 333 | llc->dev = NULL; |
334 | } | 334 | } |
335 | } | 335 | } |
336 | } else | 336 | } else |
337 | llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, | 337 | llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, |
338 | addr->sllc_mac); | 338 | addr->sllc_mac); |
339 | rcu_read_unlock(); | ||
339 | rtnl_unlock(); | 340 | rtnl_unlock(); |
340 | if (!llc->dev) | 341 | if (!llc->dev) |
341 | goto out; | 342 | goto out; |