/* * netsniff-ng - the packet sniffing beast * Copyright 2011 Daniel Borkmann. * Subject to the GPL, version 2. */ #include #include #include #include #include #include #include "die.h" #include "str.h" #include "built_in.h" #include "locking.h" #include "xmalloc.h" #include "curvetun.h" #include "curve.h" #include "curvetun_mgmt_servers.h" #include "crypto.h" struct server_store { int udp; char alias[256]; char host[256]; char port[6]; /* 5 + \0 */ unsigned char publickey[crypto_box_pub_key_size]; struct curve25519_proto proto_inf; unsigned char auth_token[crypto_auth_hmacsha512256_KEYBYTES]; struct server_store *next; }; static struct server_store *store = NULL; static struct server_store *selected = NULL; static struct rwlock store_lock; static struct server_store *server_store_alloc(void) { return xzmalloc(sizeof(struct server_store)); } static void server_store_free(struct server_store *ss) { if (!ss) return; memset(ss, 0, sizeof(struct server_store)); xfree(ss); } enum parse_states { PARSE_ALIAS, PARSE_SERVER, PARSE_PORT, PARSE_CARRIER, PARSE_PUBKEY, PARSE_DONE, }; static int parse_line(char *line, char *homedir) { char *str; enum parse_states s = PARSE_ALIAS; struct server_store *elem; unsigned char pkey[crypto_box_pub_key_size]; elem = server_store_alloc(); elem->next = store; str = strtok(line, ";"); for (; str != NULL;) { switch (s) { case PARSE_ALIAS: strlcpy(elem->alias, str, sizeof(elem->alias)); s = PARSE_SERVER; break; case PARSE_SERVER: strlcpy(elem->host, str, sizeof(elem->host)); s = PARSE_PORT; break; case PARSE_PORT: strlcpy(elem->port, str, sizeof(elem->port)); s = PARSE_CARRIER; break; case PARSE_CARRIER: if (!strncmp("udp", str, strlen("udp"))) elem->udp = 1; else if (!strncmp("tcp", str, strlen("tcp"))) elem->udp = 0; else { syslog(LOG_ERR, "Incorrect carrier type !(udp|tcp) in server spec.\n"); return -EIO; } s = PARSE_PUBKEY; break; case PARSE_PUBKEY: if (!curve25519_pubkey_hexparse_32(pkey, sizeof(pkey), str, strlen(str))) return -EINVAL; memcpy(elem->publickey, pkey, sizeof(elem->publickey)); memcpy(elem->auth_token, pkey, sizeof(elem->auth_token)); curve25519_proto_init(&elem->proto_inf, elem->publickey, sizeof(elem->publickey)); s = PARSE_DONE; break; case PARSE_DONE: break; default: return -EIO; } str = strtok(NULL, ";"); } store = elem; return s == PARSE_DONE ? 0 : -EIO; } void parse_userfile_and_generate_serv_store_or_die(char *homedir) { FILE *fp; char path[PATH_MAX], buff[1024]; int line = 1, ret; memset(path, 0, sizeof(path)); slprintf(path, sizeof(path), "%s/%s", homedir, FILE_SERVERS); rwlock_init(&store_lock); rwlock_wr_lock(&store_lock); fp = fopen(path, "r"); if (!fp) panic("Cannot open server file!\n"); memset(buff, 0, sizeof(buff)); while (fgets(buff, sizeof(buff), fp) != NULL) { buff[sizeof(buff) - 1] = 0; /* A comment. Skip this line */ if (buff[0] == '#' || buff[0] == '\n') { memset(buff, 0, sizeof(buff)); line++; continue; } ret = parse_line(buff, homedir); if (ret < 0) panic("Cannot parse line %d from clients!\n", line); line++; memset(buff, 0, sizeof(buff)); } fclose(fp); if (store == NULL) panic("No registered servers found!\n"); rwlock_unlock(&store_lock); } void dump_serv_store(void) { int i; struct server_store *elem; rwlock_rd_lock(&store_lock); elem = store; while (elem) { printf("[%s] -> %s:%s via %s -> ", elem->alias, elem->host, elem->port, elem->udp ? "udp" : "tcp"); for (i = 0; i < sizeof(elem->publickey); ++i) if (i == (sizeof(elem->publickey) - 1)) printf("%02x\n", (unsigned char) elem->publickey[i]); else printf("%02x:", (unsigned char) elem->publickey[i]); elem = elem->next; } rwlock_unlock(&store_lock); } void destroy_serv_store(void) { struct server_store *elem, *nelem = NULL; rwlock_wr_lock(&store_lock); selected = NULL; elem = store; while (elem) { nelem = elem->next; elem->next = NULL; server_store_free(elem); elem = nelem; } rwlock_unlock(&store_lock); rwlock_destroy(&store_lock); } void get_serv_store_entry_by_alias(char *alias, size_t len, char **host, char **port, int *udp) { struct server_store *elem; rwlock_rd_lock(&store_lock); elem = store; if (!alias) { while (elem && elem->next) elem = elem->next; if (elem) { (*host) = elem->host; (*port) = elem->port; (*udp) = elem->udp; selected = elem; } else { rwlock_unlock(&store_lock); goto nothing; } } else { while (elem) { if (!strncmp(elem->alias, alias, min(len, strlen(elem->alias) + 1))) break; elem = elem->next; } if (elem) { (*host) = elem->host; (*port) = elem->port; (*udp) = elem->udp; selected = elem; } else { rwlock_unlock(&store_lock); goto nothing; } } rwlock_unlock(&store_lock); return; nothing: (*host) = NULL; (*port) = NULL; (*udp) = -1; } struct curve25519_proto *get_serv_store_entry_proto_inf(void) { struct curve25519_proto *ret = NULL; rwlock_rd_lock(&store_lock); if (selected) ret = &selected->proto_inf; rwlock_unlock(&store_lock); return ret; } unsigned char *get_serv_store_entry_auth_token(void) { unsigned char *ret = NULL; rwlock_rd_lock(&store_lock); if (selected) ret = selected->auth_token; rwlock_unlock(&store_lock); return ret; } e070bc040319aaebfec09e0144dc3341'>include/trace/events/net.h parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'include/trace/events/net.h')