From fcd7e9af33132c0ca397bba35b8ca58d54548127 Mon Sep 17 00:00:00 2001 From: Konstantin Khlebnikov Date: Fri, 26 Jun 2015 13:48:17 +0300 Subject: lib/rhashtable: fix race between rhashtable_lookup_compare and hashtable resize Hash value passed as argument into rhashtable_lookup_compare could be computed using different hash table than rhashtable_lookup_compare sees. This patch passes key into rhashtable_lookup_compare() instead of hash and compures hash value right in place using the same table as for lookup. Also it adds comment for rhashtable_hashfn and rhashtable_obj_hashfn: user must prevent concurrent insert/remove otherwise returned hash value could be invalid. Signed-off-by: Konstantin Khlebnikov Fixes: e341694e3eb5 ("netlink: Convert netlink_lookup() to use RCU protected hash table") Link: http://lkml.kernel.org/r/20150514042151.GA5482@gondor.apana.org.au Cc: Stable (v3.17 .. v3.19) Signed-off-by: Sasha Levin --- lib/rhashtable.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'lib') diff --git a/lib/rhashtable.c b/lib/rhashtable.c index 624a0b7c05ef..cb22073fe687 100644 --- a/lib/rhashtable.c +++ b/lib/rhashtable.c @@ -61,6 +61,8 @@ static u32 __hashfn(const struct rhashtable *ht, const void *key, * Computes the hash value using the hash function provided in the 'hashfn' * of struct rhashtable_params. The returned value is guaranteed to be * smaller than the number of buckets in the hash table. + * + * The caller must ensure that no concurrent table mutations occur. */ u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len) { @@ -92,6 +94,8 @@ static u32 obj_hashfn(const struct rhashtable *ht, const void *ptr, u32 hsize) * 'obj_hashfn' depending on whether the hash table is set up to work with * a fixed length key. The returned value is guaranteed to be smaller than * the number of buckets in the hash table. + * + * The caller must ensure that no concurrent table mutations occur. */ u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr) { @@ -474,7 +478,7 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup); /** * rhashtable_lookup_compare - search hash table with compare function * @ht: hash table - * @hash: hash value of desired entry + * @key: pointer to key * @compare: compare function, must return true on match * @arg: argument passed on to compare function * @@ -486,14 +490,14 @@ EXPORT_SYMBOL_GPL(rhashtable_lookup); * * Returns the first entry on which the compare function returned true. */ -void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash, +void *rhashtable_lookup_compare(const struct rhashtable *ht, void *key, bool (*compare)(void *, void *), void *arg) { const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); struct rhash_head *he; + u32 hash; - if (unlikely(hash >= tbl->size)) - return NULL; + hash = __hashfn(ht, key, ht->p.key_len, tbl->size); rht_for_each_rcu(he, tbl->buckets[hash], ht) { if (!compare(rht_obj(ht, he), arg)) -- cgit v1.2.3