Skip to contentSkip to conversation

: The ip6_fib_timer can work with garbage on net namespace stop.

PATCH Applied Pavel Emelyanov 3 participants 4 messages Apr 21, 2008 – Apr 24, 2008

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Pavel Emelyanov

author
#0 lore raw

PATCH 1/1 : The ip6_fib_timer can work with garbage on net namespace stop.

The del_timer() function doesn't guarantee, that the timer callback is not active by the time it exits.

Thus, the fib6_net_exit() may kfree() all the data, that is required by the fib6_run_gc(). The race window is tiny, but slab poisoning can trigger this bug.

Using del_timer_sync() will cure this.

Signed-off-by Pavel Emelyanov <[email protected]>

---

net/ipv6/ip6_fib.c +1 -1
index 50f3f8f..1ee4fa1 100644
@@ -1543,7 +1543,7 @@ out_timer:
 static void fib6_net_exit(struct net *net)
 {
 	rt6_ifdown(net, NULL);
-	del_timer(net->ipv6.ip6_fib_timer);
+	del_timer_sync(net->ipv6.ip6_fib_timer);
 	kfree(net->ipv6.ip6_fib_timer);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 	kfree(net->ipv6.fib6_local_tbl);
maintainer Applied
#1 lore raw

From: Pavel Emelyanov <[email protected]>
Date: Mon, 21 Apr 2008 17:05:50 +0400

Quoted 10 lines

The del_timer() function doesn't guarantee, that the timer callback is not active by the time it exits.

Thus, the fib6_net_exit() may kfree() all the data, that is required by the fib6_run_gc(). The race window is tiny, but slab poisoning can trigger this bug.

Using del_timer_sync() will cure this.

Signed-off-by Pavel Emelyanov <[email protected]>

Applied, thanks Pavel.

Acked-by on v1 1/1
#2 lore raw
In reply to Pavel Emelyanov

In article <[email protected]> (at Mon, 21 Apr 2008 17:05:50 +0400), Pavel Emelyanov <[email protected]> says:

Quoted 10 lines

The del_timer() function doesn't guarantee, that the timer callback is not active by the time it exits.

Thus, the fib6_net_exit() may kfree() all the data, that is required by the fib6_run_gc(). The race window is tiny, but slab poisoning can trigger this bug.

Using del_timer_sync() will cure this.

Signed-off-by Pavel Emelyanov <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>

Also suitable for -stable.

--yoshfuji

maintainer
#3 lore raw

From: YOSHIFUJI Hideaki / 吉藤英明 <[email protected]>
Date: Thu, 24 Apr 2008 01:14:06 +0900 (JST)

Quoted 9 lines

In article <[email protected]> (at Mon, 21 Apr 2008 17:05:50 +0400), Pavel Emelyanov <[email protected]> says:

Quoted 7 lines

The del_timer() function doesn't guarantee, that the timer callback is not active by the time it exits.

Thus, the fib6_net_exit() may kfree() all the data, that is required by the fib6_run_gc(). The race window is tiny, but slab poisoning can trigger this bug.

Quoted 7 lines
Quoted 3 lines

Using del_timer_sync() will cure this.

Signed-off-by Pavel Emelyanov <[email protected]>
Acked-by YOSHIFUJI Hideaki <[email protected]>

Also suitable for -stable.

I will queue it, thanks.