diff options
| author | Daniel Borkmann <dborkman@redhat.com> | 2013-11-21 15:50:58 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-11-21 18:09:43 (GMT) |
| commit | e40526cb20b5ee53419452e1f03d97092f144418 (patch) | |
| tree | 6e78af9f31887cc85e3137ea11437bbde78515c4 /net/packet/internal.h | |
| parent | db739ef37f07a1a12e388dbaec225d9d9d5d6ded (diff) | |
| download | linux-e40526cb20b5ee53419452e1f03d97092f144418.tar.xz | |
packet: fix use after free race in send path when dev is released
Salam reported a use after free bug in PF_PACKET that occurs when
we're sending out frames on a socket bound device and suddenly the
net device is being unregistered. It appears that commit 827d9780
introduced a possible race condition between {t,}packet_snd() and
packet_notifier(). In the case of a bound socket, packet_notifier()
can drop the last reference to the net_device and {t,}packet_snd()
might end up suddenly sending a packet over a freed net_device.
To avoid reverting 827d9780 and thus introducing a performance
regression compared to the current state of things, we decided to
hold a cached RCU protected pointer to the net device and maintain
it on write side via bind spin_lock protected register_prot_hook()
and __unregister_prot_hook() calls.
In {t,}packet_snd() path, we access this pointer under rcu_read_lock
through packet_cached_dev_get() that holds reference to the device
to prevent it from being freed through packet_notifier() while
we're in send path. This is okay to do as dev_put()/dev_hold() are
per-cpu counters, so this should not be a performance issue. Also,
the code simplifies a bit as we don't need need_rls_dev anymore.
Fixes: 827d978037d7 ("af-packet: Use existing netdev reference for bound sockets.")
Reported-by: Salam Noureddine <noureddine@aristanetworks.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Salam Noureddine <noureddine@aristanetworks.com>
Cc: Ben Greear <greearb@candelatech.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/packet/internal.h')
| -rw-r--r-- | net/packet/internal.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/packet/internal.h b/net/packet/internal.h index c4e4b45..1035fa2 100644 --- a/net/packet/internal.h +++ b/net/packet/internal.h @@ -113,6 +113,7 @@ struct packet_sock { unsigned int tp_loss:1; unsigned int tp_tx_has_off:1; unsigned int tp_tstamp; + struct net_device __rcu *cached_dev; struct packet_type prot_hook ____cacheline_aligned_in_smp; }; |