netdev - Re: BUG ? ipip unregister_netdevice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20101014232804.GI2447@linux.vnet.ibm.com>
Date:	Thu, 14 Oct 2010 16:28:04 -0700
From:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	David Miller <davem@...emloft.net>, daniel.lezcano@...e.fr,
	ebiederm@...ssion.com, hans.schillstrom@...csson.com,
	netdev@...r.kernel.org
Subject: Re: BUG ? ipip unregister_netdevice_many()

On Thu, Oct 14, 2010 at 05:57:11AM +0200, Eric Dumazet wrote:
> Le mercredi 13 octobre 2010 à 16:23 -0700, David Miller a écrit :
> > From: Daniel Lezcano <daniel.lezcano@...e.fr>

[ . . . ]

> >  	for (i = 0; i <= rt_hash_mask; i++) {
> > +		struct rtable *list = NULL, **pprev;
> > +
> >  		if (process_context && need_resched())
> >  			cond_resched();
> >  		rth = rt_hash_table[i].chain;
> > @@ -726,41 +727,27 @@ static void rt_do_flush(int process_context)
> >  			continue;
> >  
> >  		spin_lock_bh(rt_hash_lock_addr(i));
> > -#ifdef CONFIG_NET_NS
> > -		{
> > -		struct rtable ** prev, * p;
> >  
> > -		rth = rt_hash_table[i].chain;
> > +		pprev = &rt_hash_table[i].chain;
> > +		rth = *pprev;
> > +		while (rth) {
> > +			next = rth->dst.rt_next;
> > +			if (dev_net(rth->dst.dev) == net) {
> 
> 		if (net_eq(dev_net(rth->dst.dev), net)) {
> 
> 
> > +				*pprev = next;
> >  
> > -		/* defer releasing the head of the list after spin_unlock */
> > -		for (tail = rth; tail; tail = tail->dst.rt_next)
> > -			if (!rt_is_expired(tail))
> > -				break;
> > -		if (rth != tail)
> > -			rt_hash_table[i].chain = tail;
> > -
> > -		/* call rt_free on entries after the tail requiring flush */
> > -		prev = &rt_hash_table[i].chain;
> > -		for (p = *prev; p; p = next) {
> > -			next = p->dst.rt_next;
> > -			if (!rt_is_expired(p)) {
> > -				prev = &p->dst.rt_next;
> > -			} else {
> > -				*prev = next;
> > -				rt_free(p);
> > -			}
> > -		}
> > +				rth->dst.rt_next = list;
> > +				list = rth;
> 
> I was wondering about RCU rules here.
> We change pointers while a reader might enter in a loop.
> It seems fine : At soon as we spin_unlock(), the loop should be closed.

I don't see where the structure pointed to by list came from, but
especially if it is newly allocated, we do need an rcu_assign_pointer().

							Thanx, Paul

> Acked-by: Eric Dumazet <eric.dumazet@...il.com>
> 
> minor coding style : You should add a brace in the else clause :
> 
> pprev = &rt_hash_table[i].chain;
> for (rth = *pprev; rth != NULL; rth = next) {
> 	next = rth->dst.rt_next;
> 	if (net_eq(dev_net(rth->dst.dev), net)) {
> 		*pprev = next;
> 		rth->dst.rt_next = list;
> 		list = rth;
> 	} else {
> 		pprev = &rth->dst.rt_next;
> 	}
> }
> 
> Thanks !
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html