genetlink: fix netns vs. netlink table locking (2)
Similar to commit d136f1bd36
,
there's a bug when unregistering a generic netlink family,
which is caught by the might_sleep() added in that commit:
BUG: sleeping function called from invalid context at net/netlink/af_netlink.c:183
in_atomic(): 1, irqs_disabled(): 0, pid: 1510, name: rmmod
2 locks held by rmmod/1510:
#0: (genl_mutex){+.+.+.}, at: [<ffffffff8138283b>] genl_unregister_family+0x2b/0x130
#1: (rcu_read_lock){.+.+..}, at: [<ffffffff8138270c>] __genl_unregister_mc_group+0x1c/0x120
Pid: 1510, comm: rmmod Not tainted 2.6.31-wl #444
Call Trace:
[<ffffffff81044ff9>] __might_sleep+0x119/0x150
[<ffffffff81380501>] netlink_table_grab+0x21/0x100
[<ffffffff813813a3>] netlink_clear_multicast_users+0x23/0x60
[<ffffffff81382761>] __genl_unregister_mc_group+0x71/0x120
[<ffffffff81382866>] genl_unregister_family+0x56/0x130
[<ffffffffa0007d85>] nl80211_exit+0x15/0x20 [cfg80211]
[<ffffffffa000005a>] cfg80211_exit+0x1a/0x40 [cfg80211]
Fix in the same way by grabbing the netlink table lock
before doing rcu_read_lock().
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
704cc92e9f
commit
b8273570f8
|
@ -187,6 +187,7 @@ extern struct sock *netlink_kernel_create(struct net *net,
|
|||
extern void netlink_kernel_release(struct sock *sk);
|
||||
extern int __netlink_change_ngroups(struct sock *sk, unsigned int groups);
|
||||
extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
|
||||
extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group);
|
||||
extern void netlink_clear_multicast_users(struct sock *sk, unsigned int group);
|
||||
extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
|
||||
extern int netlink_has_listeners(struct sock *sk, unsigned int group);
|
||||
|
|
|
@ -1609,6 +1609,16 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
|
|||
return err;
|
||||
}
|
||||
|
||||
void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct hlist_node *node;
|
||||
struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
|
||||
|
||||
sk_for_each_bound(sk, node, &tbl->mc_list)
|
||||
netlink_update_socket_mc(nlk_sk(sk), group, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* netlink_clear_multicast_users - kick off multicast listeners
|
||||
*
|
||||
|
@ -1619,15 +1629,8 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
|
|||
*/
|
||||
void netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct hlist_node *node;
|
||||
struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
|
||||
|
||||
netlink_table_grab();
|
||||
|
||||
sk_for_each_bound(sk, node, &tbl->mc_list)
|
||||
netlink_update_socket_mc(nlk_sk(sk), group, 0);
|
||||
|
||||
__netlink_clear_multicast_users(ksk, group);
|
||||
netlink_table_ungrab();
|
||||
}
|
||||
|
||||
|
|
|
@ -220,10 +220,12 @@ static void __genl_unregister_mc_group(struct genl_family *family,
|
|||
struct net *net;
|
||||
BUG_ON(grp->family != family);
|
||||
|
||||
netlink_table_grab();
|
||||
rcu_read_lock();
|
||||
for_each_net_rcu(net)
|
||||
netlink_clear_multicast_users(net->genl_sock, grp->id);
|
||||
__netlink_clear_multicast_users(net->genl_sock, grp->id);
|
||||
rcu_read_unlock();
|
||||
netlink_table_ungrab();
|
||||
|
||||
clear_bit(grp->id, mc_groups);
|
||||
list_del(&grp->list);
|
||||
|
|
Loading…
Reference in New Issue