| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <485CCFC9.2070007@cn.fujitsu.com>
Date: Sat, 21 Jun 2008 17:54:17 +0800
From: Lai Jiangshan <laijs@...fujitsu.com>
To: Andrew Morton <akpm@...ux-foundation.org>
CC: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
Luis Carlos Cobo <luisca@...ybit.com>,
Steve Whitehouse <SteveW@....org>,
Alexey Kuznetsov <kuznet@....inr.ac.ru>,
Nick Piggin <npiggin@...e.de>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [PATCH]rcu,inet,fib_trie,route,radix-tree,DECnet,mac80211: fix meaningless
rcu_dereference(local_var)
rcu_dereference is provided for fetching an RCU-protected pointer.
And rcu_dereference(local_var) is meaningless and may causes bugs.
Signed-off-by: Lai Jiangshan <laijs@...fujitsu.com>
---
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index c6f51ad..da7aada 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -166,10 +166,7 @@ static __inline__ int bad_mask(__be32 mask, __be32 addr)
static inline struct in_device *__in_dev_get_rcu(const struct net_device *dev)
{
- struct in_device *in_dev = dev->ip_ptr;
- if (in_dev)
- in_dev = rcu_dereference(in_dev);
- return in_dev;
+ return rcu_dereference(dev->ip_ptr);
}
static __inline__ struct in_device *
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 169a2f8..bfae4e2 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -703,9 +703,9 @@ __lookup(struct radix_tree_node *slot, void **results, unsigned long index,
for (i = index & RADIX_TREE_MAP_MASK; i < RADIX_TREE_MAP_SIZE; i++) {
struct radix_tree_node *node;
index++;
- node = slot->slots[i];
+ node = rcu_dereference(slot->slots[i]);
if (node) {
- results[nr_found++] = rcu_dereference(node);
+ results[nr_found++] = node;
if (nr_found == max_items)
goto out;
}
@@ -815,7 +815,7 @@ __lookup_tag(struct radix_tree_node *slot, void **results, unsigned long index,
index++;
if (!tag_get(slot, tag, j))
continue;
- node = slot->slots[j];
+ node = rcu_dereference(slot->slots[j]);
/*
* Even though the tag was found set, we need to
* recheck that we have a non-NULL node, because
@@ -827,7 +827,6 @@ __lookup_tag(struct radix_tree_node *slot, void **results, unsigned long index,
* rely on its value remaining the same).
*/
if (node) {
- node = rcu_dereference(node);
results[nr_found++] = node;
if (nr_found == max_items)
goto out;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index f50e88b..d0b61f6 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1658,27 +1658,27 @@ static struct dn_route *dn_rt_cache_get_first(struct seq_file *seq)
for(s->bucket = dn_rt_hash_mask; s->bucket >= 0; --s->bucket) {
rcu_read_lock_bh();
- rt = dn_rt_hash_table[s->bucket].chain;
+ rt = rcu_dereference(dn_rt_hash_table[s->bucket].chain);
if (rt)
break;
rcu_read_unlock_bh();
}
- return rcu_dereference(rt);
+ return rt;
}
static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
{
struct dn_rt_cache_iter_state *s = seq->private;
- rt = rt->u.dst.dn_next;
+ rt = rcu_dereference(rt->u.dst.dn_next);
while(!rt) {
rcu_read_unlock_bh();
if (--s->bucket < 0)
break;
rcu_read_lock_bh();
- rt = dn_rt_hash_table[s->bucket].chain;
+ rt = rcu_dereference(dn_rt_hash_table[s->bucket].chain);
}
- return rcu_dereference(rt);
+ return rt;
}
static void *dn_rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 4b02d14..3815328 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -174,9 +174,11 @@ static inline struct tnode *node_parent(struct node *node)
static inline struct tnode *node_parent_rcu(struct node *node)
{
- struct tnode *ret = node_parent(node);
+ struct tnode *ret = (struct tnode *)(ACCESS_ONCE(node->parent)
+ & ~NODE_TYPE_MASK);
- return rcu_dereference(ret);
+ smp_read_barrier_depends();
+ return ret;
}
/* Same as rcu_assign_pointer
@@ -197,9 +199,9 @@ static inline struct node *tnode_get_child(struct tnode *tn, unsigned int i)
static inline struct node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
{
- struct node *ret = tnode_get_child(tn, i);
+ BUG_ON(i >= 1U << tn->bits);
- return rcu_dereference(ret);
+ return rcu_dereference(tn->child[i]);
}
static inline int tnode_child_length(const struct tnode *tn)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 96be336..d02346e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -297,15 +297,15 @@ static struct rtable *__rt_cache_get_next(struct seq_file *seq,
struct rtable *r)
{
struct rt_cache_iter_state *st = seq->private;
- r = r->u.dst.rt_next;
+ r = rcu_dereference(r->u.dst.rt_next);
while (!r) {
rcu_read_unlock_bh();
if (--st->bucket < 0)
break;
rcu_read_lock_bh();
- r = rt_hash_table[st->bucket].chain;
+ r = rcu_dereference(rt_hash_table[st->bucket].chain);
}
- return rcu_dereference(r);
+ return r;
}
static struct rtable *rt_cache_get_next(struct seq_file *seq,
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index af0cd1e..16e545b 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -830,7 +830,6 @@ void mesh_path_timer(unsigned long data)
rcu_read_lock();
mpath = (struct mesh_path *) data;
- mpath = rcu_dereference(mpath);
if (!mpath)
goto endmpathtimer;
spin_lock_bh(&mpath->state_lock);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists