From patchwork Fri Jun 26 10:48:17 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konstantin Khlebnikov X-Patchwork-Id: 488736 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 392371401B5 for ; Fri, 26 Jun 2015 20:56:31 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=yandex-team.ru header.i=@yandex-team.ru header.b=VERNMK/5; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752007AbbFZK4V (ORCPT ); Fri, 26 Jun 2015 06:56:21 -0400 Received: from forward-corp1o.mail.yandex.net ([37.140.190.172]:47415 "EHLO forward-corp1o.mail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751999AbbFZK4S (ORCPT ); Fri, 26 Jun 2015 06:56:18 -0400 X-Greylist: delayed 477 seconds by postgrey-1.27 at vger.kernel.org; Fri, 26 Jun 2015 06:56:17 EDT Received: from smtpcorp1m.mail.yandex.net (smtpcorp1m.mail.yandex.net [77.88.61.150]) by forward-corp1o.mail.yandex.net (Yandex) with ESMTP id 579733920518; Fri, 26 Jun 2015 14:48:18 +0400 (MSK) Received: from smtpcorp1m.mail.yandex.net (localhost [127.0.0.1]) by smtpcorp1m.mail.yandex.net (Yandex) with ESMTP id 191982CA0594; Fri, 26 Jun 2015 13:48:18 +0300 (MSK) Received: from unknown (unknown [2a02:6b8:0:408:d534:e07c:63f:591c]) by smtpcorp1m.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id IAlNAuiQtD-mIX4bAjS; Fri, 26 Jun 2015 13:48:18 +0300 (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (Client certificate not present) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1435315698; bh=A8V2+RNyXDW1mNV3flOsLW6Y/ntDv7zDVUplLdHWCPM=; h=Subject:From:To:Date:Message-ID:User-Agent:MIME-Version: Content-Type:Content-Transfer-Encoding; b=VERNMK/5rd/9uFt6GDRon1+HPcO8gnK0daOdZj1hJTFVT783VXmpmPV+naAx5/mf7 um4xK97ra66ntMt1KRqYtLmP1uAarpKtOcSOswMTHS861kkj6VNy6hVzMCR3XvFZWW iZaQEP/bAotn5IZfLpfK9EmVuCy07s3E18ym4a1E= Authentication-Results: smtpcorp1m.mail.yandex.net; dkim=pass header.i=@yandex-team.ru Subject: [PATCH v3.17 .. v3.19] lib/rhashtable: fix race between rhashtable_lookup_compare and hashtable resize From: Konstantin Khlebnikov To: netdev , Eric Dumazet , Herbert Xu , Stable , David Miller Date: Fri, 26 Jun 2015 13:48:17 +0300 Message-ID: <20150626104817.16520.77222.stgit@buzz> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hash value passed as argument into rhashtable_lookup_compare could be computed using different hash table than rhashtable_lookup_compare sees. This patch passes key into rhashtable_lookup_compare() instead of hash and compures hash value right in place using the same table as for lookup. Also it adds comment for rhashtable_hashfn and rhashtable_obj_hashfn: user must prevent concurrent insert/remove otherwise returned hash value could be invalid. Signed-off-by: Konstantin Khlebnikov Fixes: e341694e3eb5 ("netlink: Convert netlink_lookup() to use RCU protected hash table") Link: http://lkml.kernel.org/r/20150514042151.GA5482@gondor.apana.org.au Cc: Stable (v3.17 .. v3.19) Acked-by: Thomas Graf --- include/linux/rhashtable.h | 2 +- lib/rhashtable.c | 12 ++++++++---- net/netlink/af_netlink.c | 5 +---- 3 files changed, 10 insertions(+), 9 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h index fb298e9d6d3a..84056743780a 100644 --- a/include/linux/rhashtable.h +++ b/include/linux/rhashtable.h @@ -108,7 +108,7 @@ int rhashtable_expand(struct rhashtable *ht, gfp_t flags); int rhashtable_shrink(struct rhashtable *ht, gfp_t flags); void *rhashtable_lookup(const struct rhashtable *ht, const void *key); -void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash, +void *rhashtable_lookup_compare(const struct rhashtable *ht, void *key, bool (*compare)(void *, void *), void *arg); void rhashtable_destroy(const struct rhashtable *ht); diff --git a/lib/rhashtable.c b/lib/rhashtable.c index 624a0b7c05ef..cb22073fe687 100644 --- a/lib/rhashtable.c +++ b/lib/rhashtable.c @@ -61,6 +61,8 @@ static u32 __hashfn(const struct rhashtable *ht, const void *key, * Computes the hash value using the hash function provided in the 'hashfn' * of struct rhashtable_params. The returned value is guaranteed to be * smaller than the number of buckets in the hash table. + * + * The caller must ensure that no concurrent table mutations occur. */ u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len) { @@ -92,6 +94,8 @@ static u32 obj_hashfn(const struct rhashtable *ht, const void *ptr, u32 hsize) * 'obj_hashfn' depending on whether the hash table is set up to work with * a fixed length key. The returned value is guaranteed to be smaller than * the number of buckets in the hash table. + * + * The caller must ensure that no concurrent table mutations occur. */ u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr) { @@ -474,7 +478,7 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup); /** * rhashtable_lookup_compare - search hash table with compare function * @ht: hash table - * @hash: hash value of desired entry + * @key: pointer to key * @compare: compare function, must return true on match * @arg: argument passed on to compare function * @@ -486,14 +490,14 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup); * * Returns the first entry on which the compare function returned true. */ -void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash, +void *rhashtable_lookup_compare(const struct rhashtable *ht, void *key, bool (*compare)(void *, void *), void *arg) { const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); struct rhash_head *he; + u32 hash; - if (unlikely(hash >= tbl->size)) - return NULL; + hash = __hashfn(ht, key, ht->p.key_len, tbl->size); rht_for_each_rcu(he, tbl->buckets[hash], ht) { if (!compare(rht_obj(ht, he), arg)) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index c0a418766f9c..c82b2e37e652 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1003,11 +1003,8 @@ static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid, .net = net, .portid = portid, }; - u32 hash; - hash = rhashtable_hashfn(&table->hash, &portid, sizeof(portid)); - - return rhashtable_lookup_compare(&table->hash, hash, + return rhashtable_lookup_compare(&table->hash, &portid, &netlink_compare, &arg); }