Revision a18e6a186f53af06937a2c268c72443336f4ab56 authored by Thomas Graf on 18 December 2014, 10:30:26 UTC, committed by David S. Miller on 18 December 2014, 17:35:55 UTC
Each mmap Netlink frame contains a status field which indicates
whether the frame is unused, reserved, contains data or needs to
be skipped. Both loads and stores may not be reordeded and must
complete before the status field is changed and another CPU might
pick up the frame for use. Use an smp_mb() to cover needs of both
types of callers to netlink_set_status(), callers which have been
reading data frame from the frame, and callers which have been
filling or releasing and thus writing to the frame.
- Example code path requiring a smp_rmb():
memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
- Example code path requiring a smp_wmb():
hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
netlink_frame_flush_dcache(hdr);
netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
Fixes: f9c228 ("netlink: implement memory mapped recvmsg()")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 4682a03
| File | Mode | Size |
|---|---|---|
| blocklayout | ||
| filelayout | ||
| objlayout | ||
| Kconfig | -rw-r--r-- | 5.8 KB |
| Makefile | -rw-r--r-- | 1.2 KB |
| cache_lib.c | -rw-r--r-- | 3.8 KB |
| cache_lib.h | -rw-r--r-- | 1016 bytes |
| callback.c | -rw-r--r-- | 11.9 KB |
| callback.h | -rw-r--r-- | 5.3 KB |
| callback_proc.c | -rw-r--r-- | 14.4 KB |
| callback_xdr.c | -rw-r--r-- | 25.7 KB |
| client.c | -rw-r--r-- | 37.6 KB |
| delegation.c | -rw-r--r-- | 22.6 KB |
| delegation.h | -rw-r--r-- | 2.5 KB |
| dir.c | -rw-r--r-- | 62.7 KB |
| direct.c | -rw-r--r-- | 26.9 KB |
| dns_resolve.c | -rw-r--r-- | 10.0 KB |
| dns_resolve.h | -rw-r--r-- | 812 bytes |
| file.c | -rw-r--r-- | 24.3 KB |
| fscache-index.c | -rw-r--r-- | 9.3 KB |
| fscache.c | -rw-r--r-- | 11.9 KB |
| fscache.h | -rw-r--r-- | 6.5 KB |
| getroot.c | -rw-r--r-- | 3.5 KB |
| idmap.c | -rw-r--r-- | 19.4 KB |
| inode.c | -rw-r--r-- | 53.6 KB |
| internal.h | -rw-r--r-- | 20.3 KB |
| iostat.h | -rw-r--r-- | 1.8 KB |
| mount_clnt.c | -rw-r--r-- | 12.2 KB |
| namespace.c | -rw-r--r-- | 7.3 KB |
| netns.h | -rw-r--r-- | 902 bytes |
| nfs.h | -rw-r--r-- | 993 bytes |
| nfs2super.c | -rw-r--r-- | 569 bytes |
| nfs2xdr.c | -rw-r--r-- | 25.8 KB |
| nfs3_fs.h | -rw-r--r-- | 1.0 KB |
| nfs3acl.c | -rw-r--r-- | 6.8 KB |
| nfs3client.c | -rw-r--r-- | 1.7 KB |
| nfs3proc.c | -rw-r--r-- | 23.8 KB |
| nfs3super.c | -rw-r--r-- | 656 bytes |
| nfs3xdr.c | -rw-r--r-- | 54.6 KB |
| nfs42.h | -rw-r--r-- | 430 bytes |
| nfs42proc.c | -rw-r--r-- | 3.5 KB |
| nfs42xdr.c | -rw-r--r-- | 5.7 KB |
| nfs4_fs.h | -rw-r--r-- | 17.6 KB |
| nfs4client.c | -rw-r--r-- | 30.7 KB |
| nfs4file.c | -rw-r--r-- | 4.2 KB |
| nfs4getroot.c | -rw-r--r-- | 1.2 KB |
| nfs4namespace.c | -rw-r--r-- | 12.8 KB |
| nfs4proc.c | -rw-r--r-- | 229.4 KB |
| nfs4renewd.c | -rw-r--r-- | 4.2 KB |
| nfs4session.c | -rw-r--r-- | 14.4 KB |
| nfs4session.h | -rw-r--r-- | 4.2 KB |
| nfs4state.c | -rw-r--r-- | 62.8 KB |
| nfs4super.c | -rw-r--r-- | 8.5 KB |
| nfs4sysctl.c | -rw-r--r-- | 1.4 KB |
| nfs4trace.c | -rw-r--r-- | 417 bytes |
| nfs4trace.h | -rw-r--r-- | 30.4 KB |
| nfs4xdr.c | -rw-r--r-- | 192.9 KB |
| nfsroot.c | -rw-r--r-- | 9.5 KB |
| nfstrace.c | -rw-r--r-- | 198 bytes |
| nfstrace.h | -rw-r--r-- | 18.1 KB |
| pagelist.c | -rw-r--r-- | 28.3 KB |
| pnfs.c | -rw-r--r-- | 51.8 KB |
| pnfs.h | -rw-r--r-- | 16.8 KB |
| pnfs_dev.c | -rw-r--r-- | 9.4 KB |
| proc.c | -rw-r--r-- | 18.8 KB |
| read.c | -rw-r--r-- | 10.7 KB |
| super.c | -rw-r--r-- | 74.0 KB |
| symlink.c | -rw-r--r-- | 1.6 KB |
| sysctl.c | -rw-r--r-- | 1.3 KB |
| unlink.c | -rw-r--r-- | 15.5 KB |
| write.c | -rw-r--r-- | 51.2 KB |
Computing file changes ...
