Denis Lunev ac57b3a9ce [NETLINK]: Don't attach callback to a going-away netlink socket ... There is a race between netlink_dump_start() and netlink_release() that can lead to the situation when a netlink socket with non-zero callback is freed. Here it is: CPU1: CPU2 netlink_release(): netlink_dump_start(): sk = netlink_lookup(); /* OK */ netlink_remove(); spin_lock(&nlk->cb_lock); if (nlk->cb) { /* false */ ... } spin_unlock(&nlk->cb_lock); spin_lock(&nlk->cb_lock); if (nlk->cb) { /* false */ ... } nlk->cb = cb; spin_unlock(&nlk->cb_lock); ... sock_orphan(sk); /* * proceed with releasing * the socket */ The proposal it to make sock_orphan before detaching the callback in netlink_release() and to check for the sock to be SOCK_DEAD in netlink_dump_start() before setting a new callback. Signed-off-by: Denis Lunev <den@openvz.org> Signed-off-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Pavel Emelianov <xemul@openvz.org> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2007-04-18 17:05:58 -07:00
..
af_netlink.c	[NETLINK]: Don't attach callback to a going-away netlink socket	2007-04-18 17:05:58 -07:00
attr.c	[NETLINK]: Improve string attribute validation	2006-09-22 15:18:24 -07:00
genetlink.c	[NET] NETLINK: Fix whitespace errors.	2007-02-10 23:19:58 -08:00
Makefile