]> git.baikalelectronics.ru Git - kernel.git/commit
rhashtable: Fix unprotected RCU dereference in __rht_ptr
authorHerbert Xu <herbert@gondor.apana.org.au>
Fri, 24 Jul 2020 10:12:53 +0000 (20:12 +1000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 29 Jul 2020 00:09:49 +0000 (17:09 -0700)
commitb9e6cd945393f0fa3ad8c3fc777ee47be2669764
treeb1eb0a67f3fd4c1ce0c4a8dff9ebca4bad1ace15
parentda2b6221d101740e90ec9aff6a7a09f7d2569331
rhashtable: Fix unprotected RCU dereference in __rht_ptr

The rcu_dereference call in rht_ptr_rcu is completely bogus because
we've already dereferenced the value in __rht_ptr and operated on it.
This causes potential double readings which could be fatal.  The RCU
dereference must occur prior to the comparison in __rht_ptr.

This patch changes the order of RCU dereference so that it is done
first and the result is then fed to __rht_ptr.  The RCU marking
changes have been minimised using casts which will be removed in
a follow-up patch.

Fixes: 36906ddc8aba ("rhashtable: Remove RCU marking from...")
Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/rhashtable.h