mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 10:40:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

ipv4: call dst_hold_safe() properly

Browse source 
This patch checks all the calls to
dst_hold()/skb_dst_force()/dst_clone()/dst_use() to see if
dst_hold_safe() is needed to avoid double free issue if dst
gc is removed and dst_release() directly destroys dst when
dst->__refcnt drops to 0.

In tx path, TCP hold sk->sk_rx_dst ref count and also hold sock_lock().
UDP and other similar protocols always hold refcount for
skb->_skb_refdst. So both paths seem to be safe.

In rx path, as it is lockless and skb_dst_set_noref() is likely to be
used, dst_hold_safe() should always be used when trying to hold dst.

In the routing code, if dst is held during an rcu protected session, it
is necessary to call dst_hold_safe() as the current dst might be in its
rcu grace period.

Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Wei Wang 2017-06-17 10:42:31 -07:00 committed by David S. Miller
parent 95c47f9cf5
commit 9df16efadd
2 changed files with 4 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
include/net/route.h
View file

@ -190,7 +190,9 @@ static inline int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
rcu_read_lock(); rcu_read_lock();
err = ip_route_input_noref(skb, dst, src, tos, devin); err = ip_route_input_noref(skb, dst, src, tos, devin);
if (!err) if (!err)
skb_dst_force(skb); skb_dst_force_safe(skb);
if (!skb_dst(skb))
err = -EINVAL;
rcu_read_unlock(); rcu_read_unlock();
return err; return err;

4
net/ipv4/route.c
View file

@ -2234,11 +2234,9 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
rth = rcu_dereference(*prth); rth = rcu_dereference(*prth);
rt_cache: rt_cache:
if (rt_cache_valid(rth)) { if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
dst_hold(&rth->dst);
return rth; return rth;
} }
}
add: add:
rth = rt_dst_alloc(dev_out, flags, type, rth = rt_dst_alloc(dev_out, flags, type,