From 941297f443f871b8c3372feccf27a8733f6ce9e9 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 16 Jul 2009 14:03:40 +0200 Subject: netfilter: nf_conntrack: nf_conntrack_alloc() fixes When a slab cache uses SLAB_DESTROY_BY_RCU, we must be careful when allocating objects, since slab allocator could give a freed object still used by lockless readers. In particular, nf_conntrack RCU lookups rely on ct->tuplehash[xxx].hnnode.next being always valid (ie containing a valid 'nulls' value, or a valid pointer to next object in hash chain.) kmem_cache_zalloc() setups object with NULL values, but a NULL value is not valid for ct->tuplehash[xxx].hnnode.next. Fix is to call kmem_cache_alloc() and do the zeroing ourself. As spotted by Patrick, we also need to make sure lookup keys are committed to memory before setting refcount to 1, or a lockless reader could get a reference on the old version of the object. Its key re-check could then pass the barrier. Signed-off-by: Eric Dumazet Signed-off-by: Patrick McHardy --- Documentation/RCU/rculist_nulls.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'Documentation') diff --git a/Documentation/RCU/rculist_nulls.txt b/Documentation/RCU/rculist_nulls.txt index 93cb28d05dcd..18f9651ff23d 100644 --- a/Documentation/RCU/rculist_nulls.txt +++ b/Documentation/RCU/rculist_nulls.txt @@ -83,11 +83,12 @@ not detect it missed following items in original chain. obj = kmem_cache_alloc(...); lock_chain(); // typically a spin_lock() obj->key = key; -atomic_inc(&obj->refcnt); /* * we need to make sure obj->key is updated before obj->next + * or obj->refcnt */ smp_wmb(); +atomic_set(&obj->refcnt, 1); hlist_add_head_rcu(&obj->obj_node, list); unlock_chain(); // typically a spin_unlock() @@ -159,6 +160,10 @@ out: obj = kmem_cache_alloc(cachep); lock_chain(); // typically a spin_lock() obj->key = key; +/* + * changes to obj->key must be visible before refcnt one + */ +smp_wmb(); atomic_set(&obj->refcnt, 1); /* * insert obj in RCU way (readers might be traversing chain) -- cgit v1.2.3 From 673325951ef440ebace311bd542a9378d1b3025b Mon Sep 17 00:00:00 2001 From: Ralf Baechle Date: Fri, 17 Jul 2009 04:47:19 +0000 Subject: Update Andreas Koensgen's email address The kernel has used a stale email address of Andreas for a few years. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller --- CREDITS | 2 +- Documentation/networking/6pack.txt | 2 +- MAINTAINERS | 2 +- drivers/net/hamradio/6pack.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) (limited to 'Documentation') diff --git a/CREDITS b/CREDITS index 2b88fb37ad50..e76d300e9fe4 100644 --- a/CREDITS +++ b/CREDITS @@ -1856,7 +1856,7 @@ E: rfkoenig@immd4.informatik.uni-erlangen.de D: The Linux Support Team Erlangen N: Andreas Koensgen -E: ajk@iehk.rwth-aachen.de +E: ajk@comnets.uni-bremen.de D: 6pack driver for AX.25 N: Harald Koerfgen diff --git a/Documentation/networking/6pack.txt b/Documentation/networking/6pack.txt index d0777a1200e1..8f339428fdf4 100644 --- a/Documentation/networking/6pack.txt +++ b/Documentation/networking/6pack.txt @@ -1,7 +1,7 @@ This is the 6pack-mini-HOWTO, written by Andreas Könsgen DG3KQ -Internet: ajk@iehk.rwth-aachen.de +Internet: ajk@comnets.uni-bremen.de AMPR-net: dg3kq@db0pra.ampr.org AX.25: dg3kq@db0ach.#nrw.deu.eu diff --git a/MAINTAINERS b/MAINTAINERS index 0bd82fa6d2f5..6c6bb95acb15 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -150,7 +150,7 @@ F: drivers/scsi/53c700* 6PACK NETWORK DRIVER FOR AX.25 P: Andreas Koensgen -M: ajk@iehk.rwth-aachen.de +M: ajk@comnets.uni-bremen.de L: linux-hams@vger.kernel.org S: Maintained F: drivers/net/hamradio/6pack.c diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 155160052c8b..981ab530e9ac 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -3,7 +3,7 @@ * devices like TTY. It interfaces between a raw TTY and the * kernel's AX.25 protocol layers. * - * Authors: Andreas Könsgen + * Authors: Andreas Könsgen * Ralf Baechle DL5RB * * Quite a lot of stuff "stolen" by Joerg Reuter from slip.c, written by -- cgit v1.2.3 From acb9c1b2f406d25c381de2b429f65706cc04d3b5 Mon Sep 17 00:00:00 2001 From: Evgeniy Polyakov Date: Tue, 21 Jul 2009 12:43:51 -0700 Subject: connector: maintainer/mail update. Signed-off-by: Evgeniy Polyakov Signed-off-by: David S. Miller --- Documentation/connector/cn_test.c | 4 ++-- Documentation/connector/ucon.c | 2 +- MAINTAINERS | 7 +++++++ drivers/connector/cn_queue.c | 2 +- drivers/connector/connector.c | 4 ++-- 5 files changed, 13 insertions(+), 6 deletions(-) (limited to 'Documentation') diff --git a/Documentation/connector/cn_test.c b/Documentation/connector/cn_test.c index f688eba87704..6a5be5d5c8e4 100644 --- a/Documentation/connector/cn_test.c +++ b/Documentation/connector/cn_test.c @@ -1,7 +1,7 @@ /* * cn_test.c * - * 2004-2005 Copyright (c) Evgeniy Polyakov + * 2004+ Copyright (c) Evgeniy Polyakov * All rights reserved. * * This program is free software; you can redistribute it and/or modify @@ -194,5 +194,5 @@ module_init(cn_test_init); module_exit(cn_test_fini); MODULE_LICENSE("GPL"); -MODULE_AUTHOR("Evgeniy Polyakov "); +MODULE_AUTHOR("Evgeniy Polyakov "); MODULE_DESCRIPTION("Connector's test module"); diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c index d738cde2a8d5..c5092ad0ce4b 100644 --- a/Documentation/connector/ucon.c +++ b/Documentation/connector/ucon.c @@ -1,7 +1,7 @@ /* * ucon.c * - * Copyright (c) 2004+ Evgeniy Polyakov + * Copyright (c) 2004+ Evgeniy Polyakov * * * This program is free software; you can redistribute it and/or modify diff --git a/MAINTAINERS b/MAINTAINERS index 6c6bb95acb15..88e8c00ede7f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1569,6 +1569,13 @@ S: Supported F: fs/configfs/ F: include/linux/configfs.h +CONNECTOR +P: Evgeniy Polyakov +M: zbr@ioremap.net +L: netdev@vger.kernel.org +S: Maintained +F: drivers/connector/ + CONTROL GROUPS (CGROUPS) P: Paul Menage M: menage@google.com diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c index c769ef269fb5..408c2af25d50 100644 --- a/drivers/connector/cn_queue.c +++ b/drivers/connector/cn_queue.c @@ -1,7 +1,7 @@ /* * cn_queue.c * - * 2004-2005 Copyright (c) Evgeniy Polyakov + * 2004+ Copyright (c) Evgeniy Polyakov * All rights reserved. * * This program is free software; you can redistribute it and/or modify diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index fd336c5a9057..08b2500f21ec 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -1,7 +1,7 @@ /* * connector.c * - * 2004-2005 Copyright (c) Evgeniy Polyakov + * 2004+ Copyright (c) Evgeniy Polyakov * All rights reserved. * * This program is free software; you can redistribute it and/or modify @@ -33,7 +33,7 @@ #include MODULE_LICENSE("GPL"); -MODULE_AUTHOR("Evgeniy Polyakov "); +MODULE_AUTHOR("Evgeniy Polyakov "); MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector."); static u32 cn_idx = CN_IDX_CONNECTOR; -- cgit v1.2.3