netdev - Re: open sockets preventing unregister_netdevice from completing in linux-next (next-20120724)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20120726.141047.1871303031596778701.davem@davemloft.net>
Date:	Thu, 26 Jul 2012 14:10:47 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	eric.dumazet@...il.com
Cc:	bjorn@...k.no, netdev@...r.kernel.org
Subject: Re: open sockets preventing unregister_netdevice from completing
 in linux-next (next-20120724)

From: Eric Dumazet <eric.dumazet@...il.com>
Date: Thu, 26 Jul 2012 19:15:28 +0200

> On Wed, 2012-07-25 at 15:17 -0700, David Miller wrote:
>> From: Eric Dumazet <eric.dumazet@...il.com>
>> Date: Wed, 25 Jul 2012 16:38:48 +0200
>> 
>> > Yes, we miss what was done with rt_cache_flush() : find all cached
>> > routes and release all dev references...
>> 
>> We can fix this with a two-pronged approach:
>> 
>> 1) Walk the FIB info nexthops and invalidate.
>> 
>> 2) Entries not cached in the FIB info nexthops go into a
>>    per-netns list which is scanned as well.
>> 
>> I'll try to work on this if nobody beats me to it.
> 
> With your latest patch, I can "rmmod tg3" while sockets are active.
> 
> Not sure we need all this now ?
> 
> (the trick is probably in fib_semantics.c, when you changed
> dst_release() to dst_free())

That's not the problem.  Not all routes are cached in the FIB nexthop.

Any route that doesn't resolve to a FIB info (255.255.255.255, etc.)
or uses special features (tclassid, etc.) doesn't get cached.

Therefore if a socket gets that kind of route, and then becomes
inactive, we can hold onto the device references forever.  The entity
with the route has to call dst_ops->check() to see that the route has
become invalid, but if the application is inactive, that will never
happen.

We have to put such non-cached routes into a special list or table of
some kind, so that we can zap a netdevice if it wants to go down or
unload before the final dst_release() happens.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html