evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Crash due to mutex genl_lock called from RCU context

Browse source 
Grabbing the mutex should not be done from netlink_sock_destruct() but
from netlink_release()

CRs-Fixed: 1094434
Change-Id: I69ae0d8589a0878b9758619893848afc272179c5
Signed-off-by: Eric Dumazet <edumazet@google.com>
Patch-mainline: linux-netdev @ 11/26/16, 04:54
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
This commit is contained in:
Eric Dumazet 2016-11-25 22:47:40 -07:00 • committed by Subash Abhinov Kasiviswanathan
parent 68610ce9d9
commit 9cce01579c
2 changed files with 17 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
net/netlink/af_netlink.c
View file

@ -926,16 +926,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
static void netlink_sock_destruct(struct sock *sk)
{
struct netlink_sock *nlk = nlk_sk(sk);
if (nlk->cb_running) {
if (nlk->cb.done)
nlk->cb.done(&nlk->cb);
module_put(nlk->cb.module);
kfree_skb(nlk->cb.skb);
}
skb_queue_purge(&sk->sk_receive_queue);
#ifdef CONFIG_NETLINK_MMAP
if (1) {
@ -1070,8 +1060,9 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
rcu_read_lock();
sk = __netlink_lookup(table, portid, net);
if (sk)
sock_hold(sk);
if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
sk = NULL;
rcu_read_unlock();
return sk;
@ -1198,6 +1189,7 @@ static int __netlink_create(struct net *net, struct socket *sock,
mutex_init(&nlk->pg_vec_lock);
#endif
sock_set_flag(sk, SOCK_RCU_FREE);
sk->sk_destruct = netlink_sock_destruct;
sk->sk_protocol = protocol;
return 0;
@ -1262,13 +1254,6 @@ out_module:
goto out;
}
static void deferred_put_nlk_sk(struct rcu_head *head)
{
struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
sock_put(&nlk->sk);
}
static int netlink_release(struct socket *sock)
{
struct sock *sk = sock->sk;
@ -1341,7 +1326,19 @@ static int netlink_release(struct socket *sock)
local_bh_disable();
sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
local_bh_enable();
call_rcu(&nlk->rcu, deferred_put_nlk_sk);
if (nlk->cb_running) {
mutex_lock(nlk->cb_mutex);
if (nlk->cb_running) {
if (nlk->cb.done)
nlk->cb.done(&nlk->cb);
module_put(nlk->cb.module);
kfree_skb(nlk->cb.skb);
nlk->cb_running = false;
}
mutex_unlock(nlk->cb_mutex);
}
sock_put(sk);
return 0;
}

1
net/netlink/af_netlink.h
View file

@ -52,7 +52,6 @@ struct netlink_sock {
#endif /* CONFIG_NETLINK_MMAP */
struct rhash_head node;
struct rcu_head rcu;
};
static inline struct netlink_sock *nlk_sk(struct sock *sk)