Commit 400aee84 authored by Herbert Xu's avatar Herbert Xu Committed by Thomas Graf

[NETLINK]: Fix multicast bind/autobind race

netlink_autobind has always set nlk_sk(sk)->groups to zero.  This is
unnecessary because sk_alloc already zeroes the entire structure.
Since a socket can only be bound once netlink_autobind doesn't need
to zero groups at all.

This had been safe until I added mc_list.  Now it is possible for
netlink_bind to race against netlink_autobind running on the same
socket on another CPU.  The result would be a socket that's on
mc_list with groups set to zero.  This socket will be left on the
list even after it is destroyed.

The fix is to remove the zeroing in netlink_autobind.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2c8e4372
......@@ -430,7 +430,6 @@ static int netlink_autobind(struct socket *sock)
err = netlink_insert(sk, pid);
if (err == -EADDRINUSE)
goto retry;
nlk_sk(sk)->groups = 0;
return 0;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment