Crash due to mutex genl_lock called from RCU context

Grabbing the mutex should not be done from netlink_sock_destruct() but
from netlink_release()

CRs-Fixed: 1094434
Change-Id: I69ae0d8589a0878b9758619893848afc272179c5
Signed-off-by: Eric Dumazet <edumazet@google.com>
Patch-mainline: linux-netdev @ 11/26/16, 04:54
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7a5fa0c..2b67ae1 100644 (file)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -926,16 +926,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 
 static void netlink_sock_destruct(struct sock *sk)
 {
-       struct netlink_sock *nlk = nlk_sk(sk);
-
-       if (nlk->cb_running) {
-               if (nlk->cb.done)
-                       nlk->cb.done(&nlk->cb);
-
-               module_put(nlk->cb.module);
-               kfree_skb(nlk->cb.skb);
-       }
-
        skb_queue_purge(&sk->sk_receive_queue);
 #ifdef CONFIG_NETLINK_MMAP
        if (1) {
@@ -1070,8 +1060,9 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
 
        rcu_read_lock();
        sk = __netlink_lookup(table, portid, net);
-       if (sk)
-               sock_hold(sk);
+       if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+               sk = NULL;
+
        rcu_read_unlock();
 
        return sk;
@@ -1198,6 +1189,7 @@ static int __netlink_create(struct net *net, struct socket *sock,
        mutex_init(&nlk->pg_vec_lock);
 #endif
 
+       sock_set_flag(sk, SOCK_RCU_FREE);
        sk->sk_destruct = netlink_sock_destruct;
        sk->sk_protocol = protocol;
        return 0;
@@ -1262,13 +1254,6 @@ out_module:
        goto out;
 }
 
-static void deferred_put_nlk_sk(struct rcu_head *head)
-{
-       struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
-
-       sock_put(&nlk->sk);
-}
-
 static int netlink_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
@@ -1341,7 +1326,19 @@ static int netlink_release(struct socket *sock)
        local_bh_disable();
        sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
        local_bh_enable();
-       call_rcu(&nlk->rcu, deferred_put_nlk_sk);
+       if (nlk->cb_running) {
+               mutex_lock(nlk->cb_mutex);
+               if (nlk->cb_running) {
+                       if (nlk->cb.done)
+                               nlk->cb.done(&nlk->cb);
+
+                       module_put(nlk->cb.module);
+                       kfree_skb(nlk->cb.skb);
+                       nlk->cb_running = false;
+               }
+               mutex_unlock(nlk->cb_mutex);
+       }
+       sock_put(sk);
        return 0;
 }
 

diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 14437d9..6acee01 100644 (file)
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -52,7 +52,6 @@ struct netlink_sock {
 #endif /* CONFIG_NETLINK_MMAP */
 
        struct rhash_head       node;
-       struct rcu_head         rcu;
 };
 
 static inline struct netlink_sock *nlk_sk(struct sock *sk)