diff options
| author | Dag Moxnes <dag.moxnes@oracle.com> | 2019-07-09 13:50:26 +0200 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-07-09 21:27:04 +0200 |
| commit | d8d9ec7dc5abbb3f11d866e983c4984f5c2de9d6 (patch) | |
| tree | 92fe905712b61601cef1585f016e78abc244649f /drivers/infiniband | |
| parent | RDMA/core: Make rdma_counter.h compile stand alone (diff) | |
| download | linux-d8d9ec7dc5abbb3f11d866e983c4984f5c2de9d6.tar.xz linux-d8d9ec7dc5abbb3f11d866e983c4984f5c2de9d6.zip | |
RDMA/core: Fix race when resolving IP address
Use the neighbour lock when copying the MAC address from the neighbour
data struct in dst_fetch_ha.
When not using the lock, it is possible for the function to race with
neigh_update(), causing it to copy an torn MAC address:
rdma_resolve_addr()
rdma_resolve_ip()
addr_resolve()
addr_resolve_neigh()
fetch_ha()
dst_fetch_ha()
memcpy(dev_addr->dst_dev_addr, n->ha, MAX_ADDR_LEN)
and
net_ioctl()
arp_ioctl()
arp_rec_delete()
arp_invalidate()
neigh_update()
__neigh_update()
memcpy(&neigh->ha, lladdr, dev->addr_len)
It is possible to provoke this error by calling rdma_resolve_addr() in a
tight loop, while deleting the corresponding ARP entry in another tight
loop.
Fixes: 51d45974515c ("infiniband: addr: Consolidate code to fetch neighbour hardware address from dst.")
Signed-off-by: Dag Moxnes <dag.moxnes@oracle.com>
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/core/addr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c index 2f7d14159841..9b76a8fcdd24 100644 --- a/drivers/infiniband/core/addr.c +++ b/drivers/infiniband/core/addr.c @@ -337,7 +337,7 @@ static int dst_fetch_ha(const struct dst_entry *dst, neigh_event_send(n, NULL); ret = -ENODATA; } else { - memcpy(dev_addr->dst_dev_addr, n->ha, MAX_ADDR_LEN); + neigh_ha_snapshot(dev_addr->dst_dev_addr, n, dst->dev); } neigh_release(n); |