2020-02-23 10:54:09

by Madhuparna Bhowmik

Subject: [PATCH] net: core: devlink.c: Hold devlink->lock from the beginning of devlink_dpipe_table_register()

From: Madhuparna Bhowmik <[email protected]>

devlink_dpipe_table_find() should be called under either
rcu_read_lock() or devlink->lock. devlink_dpipe_table_register()
calls devlink_dpipe_table_find() without holding the lock
and acquires it later. Therefore hold the devlink->lock
from the beginning of devlink_dpipe_table_register().

Signed-off-by: Madhuparna Bhowmik <[email protected]>
---
net/core/devlink.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 4c63c9a4c09e..61a350f59741 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -6838,26 +6838,35 @@ int devlink_dpipe_table_register(struct devlink *devlink,
void *priv, bool counter_control_extern)
{
struct devlink_dpipe_table *table;
+ int err = 0;

- if (devlink_dpipe_table_find(&devlink->dpipe_table_list, table_name))
- return -EEXIST;
+ mutex_lock(&devlink->lock);

- if (WARN_ON(!table_ops->size_get))
- return -EINVAL;
+ if (devlink_dpipe_table_find(&devlink->dpipe_table_list, table_name)) {
+ err = -EEXIST;
+ goto unlock;
+ }
+
+ if (WARN_ON(!table_ops->size_get)) {
+ err = -EINVAL;
+ goto unlock;
+ }

table = kzalloc(sizeof(*table), GFP_KERNEL);
- if (!table)
- return -ENOMEM;
+ if (!table) {
+ err = -ENOMEM;
+ goto unlock;
+ }

table->name = table_name;
table->table_ops = table_ops;
table->priv = priv;
table->counter_control_extern = counter_control_extern;

- mutex_lock(&devlink->lock);
list_add_tail_rcu(&table->list, &devlink->dpipe_table_list);
+unlock:
mutex_unlock(&devlink->lock);
- return 0;
+ return err;
}
EXPORT_SYMBOL_GPL(devlink_dpipe_table_register);

--
2.17.1

2020-02-23 11:02:07

by Jiri Pirko

Subject: Re: [PATCH] net: core: devlink.c: Hold devlink->lock from the beginning of devlink_dpipe_table_register()

Sun, Feb 23, 2020 at 11:52:53AM CET, [email protected] wrote:
>From: Madhuparna Bhowmik <[email protected]>
>
>devlink_dpipe_table_find() should be called under either
>rcu_read_lock() or devlink->lock. devlink_dpipe_table_register()
>calls devlink_dpipe_table_find() without holding the lock
>and acquires it later. Therefore hold the devlink->lock
>from the beginning of devlink_dpipe_table_register().
>
>Signed-off-by: Madhuparna Bhowmik <[email protected]>
>---
> net/core/devlink.c | 25 +++++++++++++++++--------
> 1 file changed, 17 insertions(+), 8 deletions(-)
>
>diff --git a/net/core/devlink.c b/net/core/devlink.c
>index 4c63c9a4c09e..61a350f59741 100644
>--- a/net/core/devlink.c
>+++ b/net/core/devlink.c
>@@ -6838,26 +6838,35 @@ int devlink_dpipe_table_register(struct devlink *devlink,
> void *priv, bool counter_control_extern)
> {
> struct devlink_dpipe_table *table;
>+ int err = 0;
>
>- if (devlink_dpipe_table_find(&devlink->dpipe_table_list, table_name))
>- return -EEXIST;
>+ mutex_lock(&devlink->lock);
>
>- if (WARN_ON(!table_ops->size_get))
>- return -EINVAL;
>+ if (devlink_dpipe_table_find(&devlink->dpipe_table_list, table_name)) {
>+ err = -EEXIST;
>+ goto unlock;
>+ }
>+
>+ if (WARN_ON(!table_ops->size_get)) {
>+ err = -EINVAL;
>+ goto unlock;
>+ }


Put this check out of the lock please.


>
> table = kzalloc(sizeof(*table), GFP_KERNEL);
>- if (!table)
>- return -ENOMEM;
>+ if (!table) {
>+ err = -ENOMEM;
>+ goto unlock;
>+ }
>
> table->name = table_name;
> table->table_ops = table_ops;
> table->priv = priv;
> table->counter_control_extern = counter_control_extern;
>
>- mutex_lock(&devlink->lock);
> list_add_tail_rcu(&table->list, &devlink->dpipe_table_list);
>+unlock:
> mutex_unlock(&devlink->lock);
>- return 0;
>+ return err;
> }
> EXPORT_SYMBOL_GPL(devlink_dpipe_table_register);
>
>--
>2.17.1
>