bpf: fix double free from dev_map_notification() - linux-dev - Linux kernel development work

diff options

author	Daniel Borkmann <daniel@iogearbox.net>	2017-08-21 01:48:12 +0200
committer	David S. Miller <davem@davemloft.net>	2017-08-20 19:45:54 -0700
commit	274043c6c95636e62f5b2514e78fdba82eb47601 (patch)
tree	ff2739d650ef615ede783390a9a784859e0bc3e7 /tools/perf/scripts/python/export-to-postgresql.py
parent	Merge tag 'mlx5-updates-2017-08-17-V2' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (diff)

bpf: fix double free from dev_map_notification()

In the current code, dev_map_free() can still race with dev_map_notification(). In dev_map_free(), we remove dtab from the list of dtabs after we purged all entries from it. However, we don't do xchg() with NULL or the like, so the entry at that point is still pointing to the device. If a unregister notification comes in at the same time, we therefore risk a double-free, since the pointer is still present in the map, and then pushed again to __dev_map_entry_free(). All this is completely unnecessary. Just remove the dtab from the list right before the synchronize_rcu(), so all outstanding readers from the notifier list have finished by then, thus we don't need to deal with this corner case anymore and also wouldn't need to nullify dev entires. This is fine because we iterate over the map releasing all entries and therefore dev references anyway. Fixes: 4cc7b9544b9a ("bpf: devmap fix mutex in rcu critical section") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>

Diffstat (limited to 'tools/perf/scripts/python/export-to-postgresql.py')

0 files changed, 0 insertions, 0 deletions

#ifndef FWH_LOCK_H #define FWH_LOCK_H enum fwh_lock_state { FWH_UNLOCKED = 0, FWH_DENY_WRITE = 1, FWH_IMMUTABLE = 2, FWH_DENY_READ = 4, }; struct fwh_xxlock_thunk { enum fwh_lock_state val; flstate_t state; }; #define FWH_XXLOCK_ONEBLOCK_LOCK ((struct fwh_xxlock_thunk){ FWH_DENY_WRITE, FL_LOCKING}) #define FWH_XXLOCK_ONEBLOCK_UNLOCK ((struct fwh_xxlock_thunk){ FWH_UNLOCKED, FL_UNLOCKING}) /* * This locking/unlock is specific to firmware hub parts. Only one * is known that supports the Intel command set. Firmware * hub parts cannot be interleaved as they are on the LPC bus * so this code has not been tested with interleaved chips, * and will likely fail in that context. */ static int fwh_xxlock_oneblock(struct map_info *map, struct flchip *chip, unsigned long adr, int len, void *thunk) { struct cfi_private *cfi = map->fldrv_priv; struct fwh_xxlock_thunk *xxlt = (struct fwh_xxlock_thunk *)thunk; int ret; /* Refuse the operation if the we cannot look behind the chip */ if (chip->start < 0x400000) { DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): chip->start: %lx wanted >= 0x400000\n", __func__, chip->start ); return -EIO; } /* * lock block registers: * - on 64k boundariesand * - bit 1 set high * - block lock registers are 4MiB lower - overflow subtract (danger) * * The address manipulation is first done on the logical address * which is 0 at the start of the chip, and then the offset of * the individual chip is addted to it. Any other order a weird * map offset could cause problems. */ adr = (adr & ~0xffffUL) | 0x2; adr += chip->start - 0x400000; /* * This is easy because these are writes to registers and not writes * to flash memory - that means that we don't have to check status * and timeout. */ spin_lock(chip->mutex); ret = get_chip(map, chip, adr, FL_LOCKING); if (ret) { spin_unlock(chip->mutex); return ret; } chip->oldstate = chip->state; chip->state = xxlt->state; map_write(map, CMD(xxlt->val), adr); /* Done and happy. */ chip->state = chip->oldstate; put_chip(map, chip, adr); spin_unlock(chip->mutex); return 0; } static int fwh_lock_varsize(struct mtd_info *mtd, loff_t ofs, uint64_t len) { int ret; ret = cfi_varsize_frob(mtd, fwh_xxlock_oneblock, ofs, len, (void *)&FWH_XXLOCK_ONEBLOCK_LOCK); return ret; } static int fwh_unlock_varsize(struct mtd_info *mtd, loff_t ofs, uint64_t len) { int ret; ret = cfi_varsize_frob(mtd, fwh_xxlock_oneblock, ofs, len, (void *)&FWH_XXLOCK_ONEBLOCK_UNLOCK); return ret; } static void fixup_use_fwh_lock(struct mtd_info *mtd, void *param) { printk(KERN_NOTICE "using fwh lock/unlock method\n"); /* Setup for the chips with the fwh lock method */ mtd->lock = fwh_lock_varsize; mtd->unlock = fwh_unlock_varsize; } #endif /* FWH_LOCK_H */


context:
space:
mode: