[PATCH RFC 1/5] net: rtnetlink: Fix incorrect RCU API usage
rtnl_register_internal() and rtnl_unregister_all tries to directly
dereference an RCU protected pointed outside RCU read side section.
While this is Ok to do since a lock is held, let us use the correct
API to avoid programmer bugs in the future.
This also fixes sparse warnings arising from not using RCU API.
net/core/rtnetlink.c:332:13: warning: incorrect type in assignment
(different address spaces) net/core/rtnetlink.c:332:13:expected
struct rtnl_link **tab net/core/rtnetlink.c:332:13:got struct
rtnl_link *[noderef] *
Signed-off-by: Joel Fernandes (Google)
---
net/core/rtnetlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5ea1bed08ede..98be4b4818a9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -188,7 +188,7 @@ static int rtnl_register_internal(struct module *owner,
msgindex = rtm_msgindex(msgtype);
rtnl_lock();
- tab = rtnl_msg_handlers[protocol];
+ tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
if (tab == NULL) {
tab = kcalloc(RTM_NR_MSGTYPES, sizeof(void *), GFP_KERNEL);
if (!tab)
@@ -329,7 +329,7 @@ void rtnl_unregister_all(int protocol)
BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
rtnl_lock();
- tab = rtnl_msg_handlers[protocol];
+ tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
if (!tab) {
rtnl_unlock();
return;
--
2.21.0.rc0.258.g878e2cd30e-goog
Re: [RFC 1/5] net: rtnetlink: Fix incorrect RCU API usage
On Wed, Feb 20, 2019 at 08:40:34AM -0800, Paul E. McKenney wrote:
> On Tue, Feb 19, 2019 at 11:08:23PM -0500, Joel Fernandes (Google) wrote:
> > From: Joel Fernandes
> >
> > rtnl_register_internal() and rtnl_unregister_all tries to directly
> > dereference an RCU protected pointed outside RCU read side section.
> > While this is Ok to do since a lock is held, let us use the correct
> > API to avoid programmer bugs in the future.
> >
> > This also fixes sparse warnings arising from not using RCU API.
> >
> > net/core/rtnetlink.c:332:13: warning: incorrect type in assignment
> > (different address spaces) net/core/rtnetlink.c:332:13:expected
> > struct rtnl_link **tab net/core/rtnetlink.c:332:13:got struct
> > rtnl_link *[noderef] *
> >
> > Signed-off-by: Joel Fernandes
>
> First, thank you for doing this!
No problem, it is my pleasure. It is just good to see these warnings/errors
show up (which I didn't anticipate when I first wrote the check) so we can
harden the kernel more fwiw.
> I was going to complain that these were update-side accesses, but it
> looks like rtnl_dereference() already handles both readers and updaters.
>
> So looks good to me, but the maintainers of course have the final word.
Thanks!
Also my confidence level is a bit less for patches 4/5 and 5/5, could
you share your thoughts on those? The scheduler code seems to use
rcu_assign_pointer() in those where it seems a WRITE_ONCE() would just suffice.
In fact, in some cases I replaced with smp_store_release() just to be safe.
Speaking of which, do you feel those are legit uses of rcu_assign_pointer()
or would you expect rcu_assign_pointer() to be used only for RCU protected
pointers? I am hoping it is the latter since that is what the sparse check
expects (and RCU protected pointer being assigned to).
- Joel
>
> > ---
> > net/core/rtnetlink.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> > index 5ea1bed08ede..98be4b4818a9 100644
> > --- a/net/core/rtnetlink.c
> > +++ b/net/core/rtnetlink.c
> > @@ -188,7 +188,7 @@ static int rtnl_register_internal(struct module *owner,
> > msgindex = rtm_msgindex(msgtype);
> >
> > rtnl_lock();
> > - tab = rtnl_msg_handlers[protocol];
> > + tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
> > if (tab == NULL) {
> > tab = kcalloc(RTM_NR_MSGTYPES, sizeof(void *), GFP_KERNEL);
> > if (!tab)
> > @@ -329,7 +329,7 @@ void rtnl_unregister_all(int protocol)
> > BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
> >
> > rtnl_lock();
> > - tab = rtnl_msg_handlers[protocol];
> > + tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
> > if (!tab) {
> > rtnl_unlock();
> > return;
> > --
> > 2.21.0.rc0.258.g878e2cd30e-goog
> >
>
Re: [RFC 1/5] net: rtnetlink: Fix incorrect RCU API usage
On Tue, Feb 19, 2019 at 11:08:23PM -0500, Joel Fernandes (Google) wrote:
> From: Joel Fernandes
>
> rtnl_register_internal() and rtnl_unregister_all tries to directly
> dereference an RCU protected pointed outside RCU read side section.
> While this is Ok to do since a lock is held, let us use the correct
> API to avoid programmer bugs in the future.
>
> This also fixes sparse warnings arising from not using RCU API.
>
> net/core/rtnetlink.c:332:13: warning: incorrect type in assignment
> (different address spaces) net/core/rtnetlink.c:332:13:expected
> struct rtnl_link **tab net/core/rtnetlink.c:332:13:got struct
> rtnl_link *[noderef] *
>
> Signed-off-by: Joel Fernandes
First, thank you for doing this!
I was going to complain that these were update-side accesses, but it
looks like rtnl_dereference() already handles both readers and updaters.
So looks good to me, but the maintainers of course have the final word.
Thanx, Paul
> ---
> net/core/rtnetlink.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 5ea1bed08ede..98be4b4818a9 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -188,7 +188,7 @@ static int rtnl_register_internal(struct module *owner,
> msgindex = rtm_msgindex(msgtype);
>
> rtnl_lock();
> - tab = rtnl_msg_handlers[protocol];
> + tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
> if (tab == NULL) {
> tab = kcalloc(RTM_NR_MSGTYPES, sizeof(void *), GFP_KERNEL);
> if (!tab)
> @@ -329,7 +329,7 @@ void rtnl_unregister_all(int protocol)
> BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
>
> rtnl_lock();
> - tab = rtnl_msg_handlers[protocol];
> + tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
> if (!tab) {
> rtnl_unlock();
> return;
> --
> 2.21.0.rc0.258.g878e2cd30e-goog
>
[RFC 1/5] net: rtnetlink: Fix incorrect RCU API usage
From: Joel Fernandes
rtnl_register_internal() and rtnl_unregister_all tries to directly
dereference an RCU protected pointed outside RCU read side section.
While this is Ok to do since a lock is held, let us use the correct
API to avoid programmer bugs in the future.
This also fixes sparse warnings arising from not using RCU API.
net/core/rtnetlink.c:332:13: warning: incorrect type in assignment
(different address spaces) net/core/rtnetlink.c:332:13:expected
struct rtnl_link **tab net/core/rtnetlink.c:332:13:got struct
rtnl_link *[noderef] *
Signed-off-by: Joel Fernandes
---
net/core/rtnetlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5ea1bed08ede..98be4b4818a9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -188,7 +188,7 @@ static int rtnl_register_internal(struct module *owner,
msgindex = rtm_msgindex(msgtype);
rtnl_lock();
- tab = rtnl_msg_handlers[protocol];
+ tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
if (tab == NULL) {
tab = kcalloc(RTM_NR_MSGTYPES, sizeof(void *), GFP_KERNEL);
if (!tab)
@@ -329,7 +329,7 @@ void rtnl_unregister_all(int protocol)
BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
rtnl_lock();
- tab = rtnl_msg_handlers[protocol];
+ tab = rtnl_dereference(rtnl_msg_handlers[protocol]);
if (!tab) {
rtnl_unlock();
return;
--
2.21.0.rc0.258.g878e2cd30e-goog
