netdev - [PATCH 1/2] ipv6: do not hold route table lock when send ndisc probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 17 Aug 2012 15:11:38 +0800
From:	Cong Wang <amwang@...hat.com>
To:	netdev@...r.kernel.org
Cc:	Cong Wang <amwang@...hat.com>,
	"Banerjee, Debabrata" <dbanerje@...mai.com>,
	"David S. Miller" <davem@...emloft.net>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>
Subject: [PATCH 1/2] ipv6: do not hold route table lock when send ndisc probe

In rt6_probe(), we call ndisc_send_ns() with root->rwlock,
but this is not necessary, so we can drop it before calling
ndisc_send_ns().

This could probably fix the deadlock reported by Debabrata:
https://lkml.org/lkml/2012/8/16/432

Reported-by: "Banerjee, Debabrata" <dbanerje@...mai.com>
Cc: "Banerjee, Debabrata" <dbanerje@...mai.com>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>
Cc: Patrick McHardy <kaber@...sh.net>
Signed-off-by: Cong Wang <amwang@...hat.com>
---
 net/ipv6/route.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0ddf2d1..7a36df2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -460,13 +460,18 @@ static void rt6_probe(struct rt6_info *rt)
 	    time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
 		struct in6_addr mcaddr;
 		struct in6_addr *target;
+		struct net_device *dev = rt->dst.dev;
+		struct fib6_table *table = rt->rt6i_table;
 
 		neigh->updated = jiffies;
 		read_unlock_bh(&neigh->lock);
+		read_unlock_bh(&table->tb6_lock);
 
 		target = (struct in6_addr *)&neigh->primary_key;
 		addrconf_addr_solict_mult(target, &mcaddr);
-		ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
+		ndisc_send_ns(dev, NULL, target, &mcaddr, NULL);
+
+		read_lock_bh(&table->tb6_lock);
 	} else {
 		read_unlock_bh(&neigh->lock);
 	}
-- 
1.7.7.6

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html