lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: nf_conntrack: fix the hash random initializing race

Browse Source 
nf_conntrack_alloc() isn't called with nf_conntrack_lock locked, so hash
random initializing code maybe executed more than once on different
CPUs.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Changli Gao
2010-09-16 19:55:03 +02:00
committed by Patrick McHardy
parent ed0b6d7581
commit b23909695c
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
net/netfilter/nf_conntrack_core.c
View File

@@ -65,8 +65,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked); DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked); EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
static int nf_conntrack_hash_rnd_initted; static unsigned int nf_conntrack_hash_rnd __read_mostly;
static unsigned int nf_conntrack_hash_rnd;
static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple, static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
u16 zone, unsigned int size, unsigned int rnd) u16 zone, unsigned int size, unsigned int rnd)
@@ -574,10 +573,18 @@ struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,
{ {
struct nf_conn *ct; struct nf_conn *ct;
if (unlikely(!nf_conntrack_hash_rnd_initted)) { if (unlikely(!nf_conntrack_hash_rnd)) {
get_random_bytes(&nf_conntrack_hash_rnd, unsigned int rand;
sizeof(nf_conntrack_hash_rnd));
nf_conntrack_hash_rnd_initted = 1; /*
* Why not initialize nf_conntrack_rnd in a "init()" function ?
* Because there isn't enough entropy when system initializing,
* and we initialize it as late as possible.
*/
do {
get_random_bytes(&rand, sizeof(rand));
} while (!rand);
cmpxchg(&nf_conntrack_hash_rnd, 0, rand);
} }
/* We don't want any race condition at early drop stage */ /* We don't want any race condition at early drop stage */