1. 21 Aug, 2017 1 commit
    • Daniel Borkmann's avatar
      bpf: fix double free from dev_map_notification() · 274043c6
      Daniel Borkmann authored
      In the current code, dev_map_free() can still race with dev_map_notification().
      In dev_map_free(), we remove dtab from the list of dtabs after we purged
      all entries from it. However, we don't do xchg() with NULL or the like,
      so the entry at that point is still pointing to the device. If a unregister
      notification comes in at the same time, we therefore risk a double-free,
      since the pointer is still present in the map, and then pushed again to
      __dev_map_entry_free().
      
      All this is completely unnecessary. Just remove the dtab from the list
      right before the synchronize_rcu(), so all outstanding readers from the
      notifier list have finished by then, thus we don't need to deal with this
      corner case anymore and also wouldn't need to nullify dev entires. This is
      fine because we iterate over the map releasing all entries and therefore
      dev references anyway.
      
      Fixes: 4cc7b954 ("bpf: devmap fix mutex in rcu critical section")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      274043c6
  2. 20 Aug, 2017 31 commits
  3. 19 Aug, 2017 8 commits