2018-02-21 03:43:02

by Jason A. Donenfeld

[permalink] [raw]
Subject: [PATCH] netlink: put module reference if dump start fails

Before, if cb->start() failed, the module reference would never be put,
because cb->cb_running is intentionally false at this point. Users are
generally annoyed by this because they can no longer unload modules that
leak references. Also, it may be possible to tediously wrap a reference
counter back to zero, especially since module.c still uses atomic_inc
instead of refcount_inc.

This patch expands the error path to simply call module_put if
cb->start() fails.

Signed-off-by: Jason A. Donenfeld <[email protected]>
---
This probably should be queued up for stable.

net/netlink/af_netlink.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2ad445c1d27c..07e8478068f0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2308,7 +2308,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
if (cb->start) {
ret = cb->start(cb);
if (ret)
- goto error_unlock;
+ goto error_put;
}

nlk->cb_running = true;
@@ -2328,6 +2328,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
*/
return -EINTR;

+error_put:
+ module_put(control->module);
error_unlock:
sock_put(sk);
mutex_unlock(nlk->cb_mutex);
--
2.16.1



2018-02-21 05:49:37

by Eric Dumazet

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

On Wed, 2018-02-21 at 04:41 +0100, Jason A. Donenfeld wrote:
> Before, if cb->start() failed, the module reference would never be put,
> because cb->cb_running is intentionally false at this point. Users are
> generally annoyed by this because they can no longer unload modules that
> leak references. Also, it may be possible to tediously wrap a reference
> counter back to zero, especially since module.c still uses atomic_inc
> instead of refcount_inc.
>
> This patch expands the error path to simply call module_put if
> cb->start() fails.
>
> Signed-off-by: Jason A. Donenfeld <[email protected]>
> ---
> This probably should be queued up for stable.

When was the bug added ? This would help a lot stable teams ...

Thanks.


2018-02-21 18:55:03

by Jason A. Donenfeld

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

On Wed, Feb 21, 2018 at 6:47 AM, Eric Dumazet <[email protected]> wrote:
>> This probably should be queued up for stable.
>
> When was the bug added ? This would help a lot stable teams ...

This needs to be backported to 4.16-rc0+, 4.15+, 4.14+, 4.13.14+, and 4.9.63+.

2018-02-21 18:56:07

by Eric Dumazet

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

On Wed, 2018-02-21 at 15:54 +0100, Jason A. Donenfeld wrote:
> On Wed, Feb 21, 2018 at 6:47 AM, Eric Dumazet <[email protected]> wrote:
> > > This probably should be queued up for stable.
> >
> > When was the bug added ? This would help a lot stable teams ...
>
> This needs to be backported to 4.16-rc0+, 4.15+, 4.14+, 4.13.14+, and 4.9.63+.

I guess I should have asked you to provide an appropriate Fixes: tag,
clearly identifying the commit that added the bug.

Fixes: 12-digit-sha1 ("patch title")

Thanks.


2018-02-21 18:57:22

by Jason A. Donenfeld

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

Fixes: 41c87425a1ac ("netlink: do not set cb_running if dump's start() errs")

2018-02-22 06:17:02

by Bo YU

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

Hi,
On Wed, Feb 21, 2018 at 04:41:05PM +0100, Jason A. Donenfeld wrote:
>Fixes: 41c87425a1ac ("netlink: do not set cb_running if dump's start() errs")
I think you Would better to resend it.

Bo,

2018-02-22 19:05:37

by David Miller

[permalink] [raw]
Subject: Re: [PATCH] netlink: put module reference if dump start fails

From: "Jason A. Donenfeld" <[email protected]>
Date: Wed, 21 Feb 2018 04:41:59 +0100

> Before, if cb->start() failed, the module reference would never be put,
> because cb->cb_running is intentionally false at this point. Users are
> generally annoyed by this because they can no longer unload modules that
> leak references. Also, it may be possible to tediously wrap a reference
> counter back to zero, especially since module.c still uses atomic_inc
> instead of refcount_inc.
>
> This patch expands the error path to simply call module_put if
> cb->start() fails.
>
> Signed-off-by: Jason A. Donenfeld <[email protected]>
> ---
> This probably should be queued up for stable.

Applied and queued up for -stable.