On Thu, Sep 28, 2017 at 12:31:02PM +0200, Jozsef Kadlecsik wrote: > On Wed, 27 Sep 2017, Ross Lagerwall wrote: > > > Fix a race between ip_set_dump_start() and ip_set_swap(). > > The race is as follows: > > * Without holding the ref lock, ip_set_swap() checks ref_netlink of the > > set and it is 0. > > * ip_set_dump_start() takes a reference on the set. > > * ip_set_swap() does the swap (even though it now has a non-zero > > reference count). > > * ip_set_dump_start() gets the set from ip_set_list again which is now a > > different set since it has been swapped. > > * ip_set_dump_start() calls __ip_set_put_netlink() and hits a BUG_ON due > > to the reference count being 0. > > > > Fix this race by extending the critical region in which the ref lock is > > held to include checking the ref counts. > > > > The race can be reproduced with the following script: > > while :; do > > ipset destroy hash_ip1 > > ipset destroy hash_ip2 > > ipset create hash_ip1 hash:ip family inet hashsize 1024 \ > > maxelem 500000 > > ipset create hash_ip2 hash:ip family inet hashsize 300000 \ > > maxelem 500000 > > ipset create hash_ip3 hash:ip family inet hashsize 1024 \ > > maxelem 500000 > > ipset save & > > ipset swap hash_ip3 hash_ip2 > > ipset destroy hash_ip3 > > wait > > done > > > > Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx> > > Acked-by: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx> > > Good catch, Pablo please apply in the nf tree. Thanks! Thanks a lot Jozsef. This is applied in the nf tree. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
