lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[XFRM]: Fix potential race vs xfrm_state(only)_find and xfrm_hash_resize.

Browse Source 
The _find calls calculate the hash value using the
xfrm_state_hmask, without the xfrm_state_lock. But the
value of this mask can change in the _resize call under
the state_lock, so we risk to fail in finding the desired
entry in hash.

I think, that the hash value is better to calculate
under the state lock.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pavel Emelyanov
2007-12-14 11:38:04 -08:00
committed by David S. Miller
parent 5e41fb8321
commit 4bda4f250d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/xfrm/xfrm_state.c
View File

@@ -756,7 +756,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
struct xfrm_policy *pol, int *err, struct xfrm_policy *pol, int *err,
unsigned short family) unsigned short family)
{ {
unsigned int h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family); unsigned int h;
struct hlist_node *entry; struct hlist_node *entry;
struct xfrm_state *x, *x0; struct xfrm_state *x, *x0;
int acquire_in_progress = 0; int acquire_in_progress = 0;
@@ -764,6 +764,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
struct xfrm_state *best = NULL; struct xfrm_state *best = NULL;
spin_lock_bh(&xfrm_state_lock); spin_lock_bh(&xfrm_state_lock);
h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);
hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) { hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
if (x->props.family == family && if (x->props.family == family &&
x->props.reqid == tmpl->reqid && x->props.reqid == tmpl->reqid &&
@@ -865,11 +866,12 @@ struct xfrm_state *
xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr, xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
unsigned short family, u8 mode, u8 proto, u32 reqid) unsigned short family, u8 mode, u8 proto, u32 reqid)
{ {
unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family); unsigned int h;
struct xfrm_state *rx = NULL, *x = NULL; struct xfrm_state *rx = NULL, *x = NULL;
struct hlist_node *entry; struct hlist_node *entry;
spin_lock(&xfrm_state_lock); spin_lock(&xfrm_state_lock);
h = xfrm_dst_hash(daddr, saddr, reqid, family);
hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) { hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {
if (x->props.family == family && if (x->props.family == family &&
x->props.reqid == reqid && x->props.reqid == reqid &&