net: Protect iterations over net::fib_notifier_ops in fib_seq_sum()

Kirill Tkhai · davem330 · commit 11bf284f81b4 · 2017-11-15T14:01:30.000+09:00
There is at least unlocked deletion of net-&gt;ipv4.fib_notifier_ops
from net::fib_notifier_ops:

ip_fib_net_exit()
  rtnl_unlock()
  fib4_notifier_exit()
    fib_notifier_ops_unregister(net-&gt;ipv4.notifier_ops)
      list_del_rcu(&amp;ops-&gt;list)

So fib_seq_sum() can't use rtnl_lock() only for protection.

The possible solution could be to use rtnl_lock()
in fib_notifier_ops_unregister(), but this adds
a possible delay during net namespace creation,
so we better use rcu_read_lock() till someone
really needs the mutex (if that happens).

Signed-off-by: Kirill Tkhai &lt;ktkhai@virtuozzo.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/core/fib_notifier.c b/net/core/fib_notifier.c
@@ -34,12 +34,14 @@ static unsigned int fib_seq_sum(void)
 
 	rtnl_lock();
 	for_each_net(net) {
-		list_for_each_entry(ops, &net->fib_notifier_ops, list) {
+		rcu_read_lock();
+		list_for_each_entry_rcu(ops, &net->fib_notifier_ops, list) {
 			if (!try_module_get(ops->owner))
 				continue;
 			fib_seq += ops->fib_seq_read(net);
 			module_put(ops->owner);
 		}
+		rcu_read_unlock();
 	}
 	rtnl_unlock();
 

Original file line number	Diff line number	Diff line change
`@@ -34,12 +34,14 @@ static unsigned int fib_seq_sum(void)`
`34`	`34`
`35`	`35`	`rtnl_lock();`
`36`	`36`	`for_each_net(net) {`
`37`		`- list_for_each_entry(ops, &net->fib_notifier_ops, list) {`
	`37`	`+ rcu_read_lock();`
	`38`	`+ list_for_each_entry_rcu(ops, &net->fib_notifier_ops, list) {`
`38`	`39`	`if (!try_module_get(ops->owner))`
`39`	`40`	`continue;`
`40`	`41`	`fib_seq += ops->fib_seq_read(net);`
`41`	`42`	`module_put(ops->owner);`
`42`	`43`	`}`
	`44`	`+ rcu_read_unlock();`
`43`	`45`	`}`
`44`	`46`	`rtnl_unlock();`
`45`	`47`