[NETLINK]: Fix multicast bind/autobind race

Linux Kernel Mailing List <[email protected]> Thu, 17 Mar 2005 04:37:38 +0000
Newsgroups gmane.linux.kernel.commits.2-4
Message-ID <[email protected]>
ChangeSet 1.1448.127.5, 2005/03/16 20:37:38-08:00, [email protected]

	[NETLINK]: Fix multicast bind/autobind race
	
	netlink_autobind has always set nlk_sk(sk)->groups to zero.  This is
	unnecessary because sk_alloc already zeroes the entire structure.
	Since a socket can only be bound once netlink_autobind doesn't need
	to zero groups at all.
	
	This had been safe until I added mc_list.  Now it is possible for
	netlink_bind to race against netlink_autobind running on the same
	socket on another CPU.  The result would be a socket that's on
	mc_list with groups set to zero.  This socket will be left on the
	list even after it is destroyed.
	
	The fix is to remove the zeroing in netlink_autobind.
	
	Signed-off-by: Herbert Xu <[email protected]>
	Signed-off-by: David S. Miller <[email protected]>



 af_netlink.c |    1 -
 1 files changed, 1 deletion(-)


diff -Nru a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
--- a/net/netlink/af_netlink.c	2005-03-25 17:03:20 -08:00
+++ b/net/netlink/af_netlink.c	2005-03-25 17:03:20 -08:00
@@ -450,7 +450,6 @@
 	err = netlink_insert(sk, pid);
 	if (err == -EADDRINUSE)
 		goto retry;
-	sk->protinfo.af_netlink->groups = 0;
 	return 0;
 }