• Herbert Xu's avatar
    [NETLINK]: Fix multicast bind/autobind race · 400aee84
    Herbert Xu authored
    netlink_autobind has always set nlk_sk(sk)->groups to zero.  This is
    unnecessary because sk_alloc already zeroes the entire structure.
    Since a socket can only be bound once netlink_autobind doesn't need
    to zero groups at all.
    
    This had been safe until I added mc_list.  Now it is possible for
    netlink_bind to race against netlink_autobind running on the same
    socket on another CPU.  The result would be a socket that's on
    mc_list with groups set to zero.  This socket will be left on the
    list even after it is destroyed.
    
    The fix is to remove the zeroing in netlink_autobind.
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    400aee84
af_netlink.c 31.1 KB