Skip to contentSkip to conversation

rhashtable: warnings caused by "rhashtable: Fix use-after-free in rhashtable_walk_stop"

DISCUSSION Applied Sasha Levin 3 participants 4 messages Mar 23, 2015 – Mar 24, 2015

Subsystems (4)
lore
Share & tools
lore
#0 lore raw

Hi all,

Commit 963ecbd41a ("rhashtable: Fix use-after-free in rhashtable_walk_stop") is causing RCU warnings since the code now locks a mutex (which might sleep) within an RCU critical section within rhashtable_walk_stop().

Thanks,
Sasha

maintainer
#1 lore raw
Quoted 5 lines · Sasha Levin

Hi all,

Commit 963ecbd41a ("rhashtable: Fix use-after-free in rhashtable_walk_stop") is causing RCU warnings since the code now locks a mutex (which might sleep) within an RCU critical section within rhashtable_walk_stop().

OK I will add a spin lock to bucket_table for this.

Cheers,

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer
#2 lore raw
Quoted 7 lines · Herbert Xu
Quoted 4 lines · Sasha Levin

Commit 963ecbd41a ("rhashtable: Fix use-after-free in rhashtable_walk_stop") is causing RCU warnings since the code now locks a mutex (which might sleep) within an RCU critical section within rhashtable_walk_stop().

OK I will add a spin lock to bucket_table for this.

---8<---
rhashtable: Fix sleeping inside RCU critical section in walk_stop

The commit 963ecbd41a1026d99ec7537c050867428c397b89 ("rhashtable:
Fix use-after-free in rhashtable_walk_stop") fixed a real bug but created another one because we may end up sleeping inside an RCU critical section.

This patch fixes it properly by replacing the mutex with a spin lock that specifically protects the walker lists.

include/linux/rhashtable.h +2 -0
index 57af1e9..14db673 100644
@@ -133,6 +133,7 @@ struct rhashtable_params {
  * @p: Configuration parameters
  * @run_work: Deferred worker to expand/shrink asynchronously
  * @mutex: Mutex to protect current/future table swapping
+ * @lock: Spin lock to protect walker list
  * @being_destroyed: True if table is set up for destruction
  */
 struct rhashtable {
@@ -144,6 +145,7 @@ struct rhashtable {
 	struct rhashtable_params	p;
 	struct work_struct		run_work;
 	struct mutex                    mutex;
+	spinlock_t			lock;
 };
 
 /**
lib/rhashtable.c +5 -2
index 7686c1e..e96ad1a 100644
@@ -256,8 +256,10 @@ static int rhashtable_rehash_table(struct rhashtable *ht)
 	/* Publish the new table pointer. */
 	rcu_assign_pointer(ht->tbl, new_tbl);
 
+	spin_lock(&ht->lock);
 	list_for_each_entry(walker, &old_tbl->walkers, list)
 		walker->tbl = NULL;
+	spin_unlock(&ht->lock);
 
 	/* Wait for readers. All new readers will see the new
 	 * table, and thus no references to the old table will
@@ -635,12 +637,12 @@ void rhashtable_walk_stop(struct rhashtable_iter *iter)
 
 	ht = iter->ht;
 
-	mutex_lock(&ht->mutex);
+	spin_lock(&ht->lock);
 	if (tbl->rehash < tbl->size)
 		list_add(&iter->walker->list, &tbl->walkers);
 	else
 		iter->walker->tbl = NULL;
-	mutex_unlock(&ht->mutex);
+	spin_unlock(&ht->lock);
 
 	iter->p = NULL;
 
@@ -723,6 +725,7 @@ int rhashtable_init(struct rhashtable *ht,
 
 	memset(ht, 0, sizeof(*ht));
 	mutex_init(&ht->mutex);
+	spin_lock_init(&ht->lock);
 	memcpy(&ht->p, params, sizeof(*params));
 
 	if (params->min_size)
Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#3 lore raw

From: Herbert Xu <[email protected]>
Date: Tue, 24 Mar 2015 09:53:17 +1100

Quoted 7 lines

rhashtable: Fix sleeping inside RCU critical section in walk_stop

The commit 963ecbd41a1026d99ec7537c050867428c397b89 ("rhashtable:
Fix use-after-free in rhashtable_walk_stop") fixed a real bug but created another one because we may end up sleeping inside an RCU critical section.

Quoted 5 lines

This patch fixes it properly by replacing the mutex with a spin lock that specifically protects the walker lists.

Applied, thanks everyone.