diff options
| author | Sowmini Varadhan <sowmini.varadhan@oracle.com> | 2018-02-03 04:26:51 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-02-08 15:23:52 -0500 |
| commit | ebeeb1ad9b8adcc37c2ec21a96f39e9d35199b46 (patch) | |
| tree | 25c1f3a044ab1c8f8e15031f606b00ae35db2ed0 /net/rds/cong.c | |
| parent | 79a8a642bf05cd0dced20621f6fef9d884124abd (diff) | |
| download | linux-ebeeb1ad9b8adcc37c2ec21a96f39e9d35199b46.tar.gz linux-ebeeb1ad9b8adcc37c2ec21a96f39e9d35199b46.tar.bz2 linux-ebeeb1ad9b8adcc37c2ec21a96f39e9d35199b46.zip | |
rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management
An rds_connection can get added during netns deletion between lines 528
and 529 of
506 static void rds_tcp_kill_sock(struct net *net)
:
/* code to pull out all the rds_connections that should be destroyed */
:
528 spin_unlock_irq(&rds_tcp_conn_lock);
529 list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node)
530 rds_conn_destroy(tc->t_cpath->cp_conn);
Such an rds_connection would miss out the rds_conn_destroy()
loop (that cancels all pending work) and (if it was scheduled
after netns deletion) could trigger the use-after-free.
A similar race-window exists for the module unload path
in rds_tcp_exit -> rds_tcp_destroy_conns
Concurrency with netns deletion (rds_tcp_kill_sock()) must be handled
by checking check_net() before enqueuing new work or adding new
connections.
Concurrency with module-unload is handled by maintaining a module
specific flag that is set at the start of the module exit function,
and must be checked before enqueuing new work or adding new connections.
This commit refactors existing RDS_DESTROY_PENDING checks added by
commit 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with
connection teardown") and consolidates all the concurrency checks
listed above into the function rds_destroy_pending().
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rds/cong.c')
| -rw-r--r-- | net/rds/cong.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/rds/cong.c b/net/rds/cong.c index 8d19fd25dce3..63da9d2f142d 100644 --- a/net/rds/cong.c +++ b/net/rds/cong.c @@ -223,7 +223,7 @@ void rds_cong_queue_updates(struct rds_cong_map *map) rcu_read_lock(); if (!test_and_set_bit(0, &conn->c_map_queued) && - !test_bit(RDS_DESTROY_PENDING, &cp->cp_flags)) { + !rds_destroy_pending(cp->cp_conn)) { rds_stats_inc(s_cong_update_queued); /* We cannot inline the call to rds_send_xmit() here * for two reasons (both pertaining to a TCP transport): |