diff options
author | Pavel Emelyanov <xemul@openvz.org> | 2008-04-14 03:44:52 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-04-14 03:44:52 -0400 |
commit | 4dee959723e2bf3a0f9343a46841cd2f0029d424 (patch) | |
tree | a7ae0cedd9dccee806b6a7ba6a7e017a271850ca | |
parent | 9625ed72e8bd619c3984f3024bd37143b7f0c7b0 (diff) |
[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
Consider we are putting a clusterip_config entry with the "entries"
count == 1, and on the other CPU there's a clusterip_config_find_get
in progress:
CPU1: CPU2:
clusterip_config_entry_put: clusterip_config_find_get:
if (atomic_dec_and_test(&c->entries)) {
/* true */
read_lock_bh(&clusterip_lock);
c = __clusterip_config_find(clusterip);
/* found - it's still in list */
...
atomic_inc(&c->entries);
read_unlock_bh(&clusterip_lock);
write_lock_bh(&clusterip_lock);
list_del(&c->list);
write_unlock_bh(&clusterip_lock);
...
dev_put(c->dev);
Oops! We have an entry returned by the clusterip_config_find_get,
which is a) not in list b) has a stale dev pointer.
The problems will happen when the CPU2 will release the entry - it
will remove it from the list for the 2nd time, thus spoiling it, and
will put a stale dev pointer.
The fix is to make atomic_dec_and_test under the clusterip_lock.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
-rw-r--r-- | net/ipv4/netfilter/ipt_CLUSTERIP.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c index 52926c8e3cc1..a12dd329e208 100644 --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c | |||
@@ -82,8 +82,8 @@ clusterip_config_put(struct clusterip_config *c) | |||
82 | static inline void | 82 | static inline void |
83 | clusterip_config_entry_put(struct clusterip_config *c) | 83 | clusterip_config_entry_put(struct clusterip_config *c) |
84 | { | 84 | { |
85 | write_lock_bh(&clusterip_lock); | ||
85 | if (atomic_dec_and_test(&c->entries)) { | 86 | if (atomic_dec_and_test(&c->entries)) { |
86 | write_lock_bh(&clusterip_lock); | ||
87 | list_del(&c->list); | 87 | list_del(&c->list); |
88 | write_unlock_bh(&clusterip_lock); | 88 | write_unlock_bh(&clusterip_lock); |
89 | 89 | ||
@@ -96,7 +96,9 @@ clusterip_config_entry_put(struct clusterip_config *c) | |||
96 | #ifdef CONFIG_PROC_FS | 96 | #ifdef CONFIG_PROC_FS |
97 | remove_proc_entry(c->pde->name, c->pde->parent); | 97 | remove_proc_entry(c->pde->name, c->pde->parent); |
98 | #endif | 98 | #endif |
99 | return; | ||
99 | } | 100 | } |
101 | write_unlock_bh(&clusterip_lock); | ||
100 | } | 102 | } |
101 | 103 | ||
102 | static struct clusterip_config * | 104 | static struct clusterip_config * |