netdev - Re: Reference counting struct inet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170124.142035.1532512255377175036.davem@davemloft.net>
Date:   Tue, 24 Jan 2017 14:20:35 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     dwindsor@...il.com
Cc:     netdev@...r.kernel.org, keescook@...omium.org,
        elena.reshetova@...el.com, ishkamiel@...il.com
Subject: Re: Reference counting struct inet_peer

From: David Windsor <dwindsor@...il.com>
Date: Mon, 23 Jan 2017 07:42:51 -0500

> struct inet_peer objects get freed when their reference count
> becomes -1, not 0 as is the usual case.  Is there a reason why this
> is so?

inet peer entries that sit in the tree, but have no other reference
taken, have a reference count of zero.

Therefore, any entry which has a reference count of zero can be
safely garbage collected from the tree.

When the garbage collector purges entries with a zero refcnt, it
atomically sets the refcnt to -1 so that other threads of control
in RCU protected sections that still see this entry in the tree
will not be able to grab it for use.

The -1 marker is used as a synchronization mechanism between the
GC and lookup paths.

Once -1 is atomically set, the GC code knows that no external
reference can be created.