[NET]: Fix the race between sk_filter_(de|at)tach and sk_clone()

[net-next-2.6.git] / net / core / filter.c

diff --git a/net/core/filter.c b/net/core/filter.c
index 54dddc92452dc226f2ba6232cdc43f4a89a9cb9b..1f0068eae5018948ec187aa31af5a7ce5ed44fde 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -386,6 +386,25 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
        return (BPF_CLASS(filter[flen - 1].code) == BPF_RET) ? 0 : -EINVAL;
 }
 
+/**
+ *     sk_filter_rcu_release: Release a socket filter by rcu_head
+ *     @rcu: rcu_head that contains the sk_filter to free
+ */
+static void sk_filter_rcu_release(struct rcu_head *rcu)
+{
+       struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
+
+       sk_filter_release(fp);
+}
+
+static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
+{
+       unsigned int size = sk_filter_len(fp);
+
+       atomic_sub(size, &sk->sk_omem_alloc);
+       call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+}
+
 /**
  *     sk_attach_filter - attach a socket filter
  *     @fprog: the filter program
@@ -428,7 +447,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
        rcu_assign_pointer(sk->sk_filter, fp);
        rcu_read_unlock_bh();
 
-       sk_filter_uncharge(sk, old_fp);
+       sk_filter_delayed_uncharge(sk, old_fp);
        return 0;
 }
 
@@ -441,7 +460,7 @@ int sk_detach_filter(struct sock *sk)
        filter = rcu_dereference(sk->sk_filter);
        if (filter) {
                rcu_assign_pointer(sk->sk_filter, NULL);
-               sk_filter_uncharge(sk, filter);
+               sk_filter_delayed_uncharge(sk, filter);
                ret = 0;
        }
        rcu_read_unlock_bh();