[GENETLINK]: Fix race in genl_unregister_mc_groups()
family->mcast_groups is protected by genl_lock so it must
be held while accessing the list in genl_unregister_mc_groups().
Requires adding a non-locking variant of genl_unregister_mc_group().
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index e146531..61d6556 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -200,6 +200,18 @@
}
EXPORT_SYMBOL(genl_register_mc_group);
+static void __genl_unregister_mc_group(struct genl_family *family,
+ struct genl_multicast_group *grp)
+{
+ BUG_ON(grp->family != family);
+ netlink_clear_multicast_users(genl_sock, grp->id);
+ clear_bit(grp->id, mc_groups);
+ list_del(&grp->list);
+ genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
+ grp->id = 0;
+ grp->family = NULL;
+}
+
/**
* genl_unregister_mc_group - unregister a multicast group
*
@@ -217,14 +229,8 @@
void genl_unregister_mc_group(struct genl_family *family,
struct genl_multicast_group *grp)
{
- BUG_ON(grp->family != family);
genl_lock();
- netlink_clear_multicast_users(genl_sock, grp->id);
- clear_bit(grp->id, mc_groups);
- list_del(&grp->list);
- genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
- grp->id = 0;
- grp->family = NULL;
+ __genl_unregister_mc_group(family, grp);
genl_unlock();
}
@@ -232,8 +238,10 @@
{
struct genl_multicast_group *grp, *tmp;
+ genl_lock();
list_for_each_entry_safe(grp, tmp, &family->mcast_groups, list)
- genl_unregister_mc_group(family, grp);
+ __genl_unregister_mc_group(family, grp);
+ genl_unlock();
}
/**