[PATCH 1/1] neighbour: Fixed race condition at tbl->nht

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado <redacted>
CC: "David S. Miller" <davem@davemloft.net>
CC: Eric Dumazet <redacted>
---

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e287346..2a83914 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c

@@ -826,6 +826,8 @@ next_elt:
 		write_unlock_bh(&tbl->lock);
 		cond_resched();
 		write_lock_bh(&tbl->lock);
+		nht = rcu_dereference_protected(tbl->nht,
+						lockdep_is_held(&tbl->lock));
 	}
 	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
 	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2

Le mardi 21 février 2012 à 16:04 -0500, Michel Machado a écrit :

Nice catch !

Bug introduced in 2.6.37 in commit d6bf781712a (net neigh: RCU
conversion of neigh hash table)

Acked-by: Eric Dumazet <redacted>

From: Eric Dumazet <redacted>
Date: Tue, 21 Feb 2012 22:25:22 +0100

Le mardi 21 février 2012 à 16:04 -0500, Michel Machado a écrit :

quoted

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado <redacted>

 ...

Nice catch !

Bug introduced in 2.6.37 in commit d6bf781712a (net neigh: RCU
conversion of neigh hash table)

Acked-by: Eric Dumazet <redacted>

Applied, and queued up for -stable, thanks.