linux-hardened/net/core
Neil Horman 7b363e4400 netpoll: fix race on poll_list resulting in garbage entry
A few months back a race was discused between the netpoll napi service
path, and the fast path through net_rx_action:
http://kerneltrap.org/mailarchive/linux-netdev/2007/10/16/345470

A patch was submitted for that bug, but I think we missed a case.

Consider the following scenario:

INITIAL STATE
CPU0 has one napi_struct A on its poll_list
CPU1 is calling netpoll_send_skb and needs to call poll_napi on the same
napi_struct A that CPU0 has on its list



CPU0						CPU1
net_rx_action					poll_napi
!list_empty (returns true)			locks poll_lock for A
						 poll_one_napi
						  napi->poll
						   netif_rx_complete
						    __napi_complete
						    (removes A from poll_list)
list_entry(list->next)


In the above scenario, net_rx_action assumes that the per-cpu poll_list is
exclusive to that cpu.  netpoll of course violates that, and because the netpoll
path can dequeue from the poll list, its possible for CPU0 to detect a non-empty
list at the top of the while loop in net_rx_action, but have it become empty by
the time it calls list_entry.  Since the poll_list isn't surrounded by any other
structure, the returned data from that list_entry call in this situation is
garbage, and any number of crashes can result based on what exactly that garbage
is.

Given that its not fasible for performance reasons to place exclusive locks
arround each cpus poll list to provide that mutal exclusion, I think the best
solution is modify the netpoll path in such a way that we continue to guarantee
that the poll_list for a cpu is in fact exclusive to that cpu.  To do this I've
implemented the patch below.  It adds an additional bit to the state field in
the napi_struct.  When executing napi->poll from the netpoll_path, this bit will
be set. When a driver calls netif_rx_complete, if that bit is set, it will not
remove the napi_struct from the poll_list.  That work will be saved for the next
iteration of net_rx_action.

I've tested this and it seems to work well.  About the biggest drawback I can
see to it is the fact that it might result in an extra loop through
net_rx_action in the event that the device is actually contended for (i.e. the
netpoll path actually preforms all the needed work no the device, and the call
to net_rx_action winds up doing nothing, except removing the napi_struct from
the poll_list.  However I think this is probably a small price to pay, given
that the alternative is a crash.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-09 23:22:26 -08:00
..
datagram.c net: Rationalise email address: Network Specific Parts 2008-10-13 19:01:08 -07:00
dev.c net: fix packet socket delivery in rx irq handler 2008-11-04 14:49:57 -08:00
dev_mcast.c net: Rationalise email address: Network Specific Parts 2008-10-13 19:01:08 -07:00
dst.c net: fix scheduling of dst_gc_task by __dst_free 2008-09-12 16:16:37 -07:00
ethtool.c netdev: Add support for rx flow hash configuration, using ethtool. 2008-07-02 03:47:41 -07:00
fib_rules.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-07-05 23:08:07 -07:00
filter.c net: Tyop of sk_filter() comment 2008-07-01 19:55:40 -07:00
flow.c smp_call_function: get rid of the unused nonatomic/retry argument 2008-06-26 11:24:35 +02:00
gen_estimator.c Revert "pkt_sched: Protect gen estimators under est_lock." 2008-08-18 22:32:10 -07:00
gen_stats.c [NET_SCHED]: Convert packet schedulers from rtnetlink to new netlink API 2008-01-28 15:11:10 -08:00
iovec.c net: Use standard structures for generic socket address structures. 2008-07-19 22:35:47 -07:00
kmap_skb.h [PATCH] severing skbuff.h -> highmem.h 2006-12-04 02:00:29 -05:00
link_watch.c net: Clean up explicit ->tx_queue references in link watch. 2008-07-08 23:01:06 -07:00
Makefile net: Add SKB DMA mapping helper functions. 2008-09-11 04:51:14 -07:00
neighbour.c neigh: Remove by-hand SKB queue handling. 2008-09-23 01:11:18 -07:00
net-sysfs.c net: network device name ifalias support 2008-09-22 21:28:11 -07:00
net-sysfs.h netns: Fix device renaming for sysfs 2008-05-02 17:00:58 -07:00
net_namespace.c netns: add register_pernet_gen_subsys/unregister_pernet_gen_subsys 2008-10-30 23:55:16 -07:00
netevent.c [NET]: net/core/netevent.c should #include <net/netevent.h> 2007-07-05 17:40:27 -07:00
netpoll.c netpoll: fix race on poll_list resulting in garbage entry 2008-12-09 23:22:26 -08:00
pktgen.c pktgen: fix multiple queue warning 2008-11-19 14:09:47 -08:00
request_sock.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
rtnetlink.c rtnetlink: propagate error from dev_change_flags in do_setlink() 2008-11-16 23:20:31 -08:00
scm.c scm: fix scm_fp_list->list initialization made in wrong place 2008-11-14 14:51:45 -08:00
skb_dma_map.c net: Fix off-by-one in skb_dma_map 2008-10-12 21:07:34 -07:00
skbuff.c net: make skb_truesize_bug() call WARN() 2008-11-25 21:08:13 -08:00
sock.c net: Fix memory leak in the proto_register function 2008-11-21 16:45:22 -08:00
stream.c net: Rationalise email address: Network Specific Parts 2008-10-13 19:01:08 -07:00
sysctl_net_core.c printk ratelimiting rewrite 2008-07-25 10:53:29 -07:00
user_dma.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2008-07-26 20:17:56 -07:00
utils.c printk ratelimiting rewrite 2008-07-25 10:53:29 -07:00