aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorPavel Emelyanov <xemul@openvz.org>2008-04-14 03:44:52 -0400
committerDavid S. Miller <davem@davemloft.net>2008-04-14 03:44:52 -0400
commit4dee959723e2bf3a0f9343a46841cd2f0029d424 (patch)
treea7ae0cedd9dccee806b6a7ba6a7e017a271850ca /net/ipv4
parent9625ed72e8bd619c3984f3024bd37143b7f0c7b0 (diff)
[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
Consider we are putting a clusterip_config entry with the "entries" count == 1, and on the other CPU there's a clusterip_config_find_get in progress: CPU1: CPU2: clusterip_config_entry_put: clusterip_config_find_get: if (atomic_dec_and_test(&c->entries)) { /* true */ read_lock_bh(&clusterip_lock); c = __clusterip_config_find(clusterip); /* found - it's still in list */ ... atomic_inc(&c->entries); read_unlock_bh(&clusterip_lock); write_lock_bh(&clusterip_lock); list_del(&c->list); write_unlock_bh(&clusterip_lock); ... dev_put(c->dev); Oops! We have an entry returned by the clusterip_config_find_get, which is a) not in list b) has a stale dev pointer. The problems will happen when the CPU2 will release the entry - it will remove it from the list for the 2nd time, thus spoiling it, and will put a stale dev pointer. The fix is to make atomic_dec_and_test under the clusterip_lock. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/netfilter/ipt_CLUSTERIP.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 52926c8e3cc1..a12dd329e208 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -82,8 +82,8 @@ clusterip_config_put(struct clusterip_config *c)
82static inline void 82static inline void
83clusterip_config_entry_put(struct clusterip_config *c) 83clusterip_config_entry_put(struct clusterip_config *c)
84{ 84{
85 write_lock_bh(&clusterip_lock);
85 if (atomic_dec_and_test(&c->entries)) { 86 if (atomic_dec_and_test(&c->entries)) {
86 write_lock_bh(&clusterip_lock);
87 list_del(&c->list); 87 list_del(&c->list);
88 write_unlock_bh(&clusterip_lock); 88 write_unlock_bh(&clusterip_lock);
89 89
@@ -96,7 +96,9 @@ clusterip_config_entry_put(struct clusterip_config *c)
96#ifdef CONFIG_PROC_FS 96#ifdef CONFIG_PROC_FS
97 remove_proc_entry(c->pde->name, c->pde->parent); 97 remove_proc_entry(c->pde->name, c->pde->parent);
98#endif 98#endif
99 return;
99 } 100 }
101 write_unlock_bh(&clusterip_lock);
100} 102}
101 103
102static struct clusterip_config * 104static struct clusterip_config *