diff options
| author | Wei Wang <weiwan@google.com> | 2017-06-17 10:42:31 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-06-17 22:54:00 -0400 |
| commit | 9df16efadd2a8a82731dc76ff656c771e261827f (patch) | |
| tree | e43af92481dcf7517e8c7e086cfccecbc6bd0792 /net/ipv4 | |
| parent | 95c47f9cf5e028d1ae77dc6c767c1edc8a18025b (diff) | |
| download | linux-9df16efadd2a8a82731dc76ff656c771e261827f.tar.bz2 | |
ipv4: call dst_hold_safe() properly
This patch checks all the calls to
dst_hold()/skb_dst_force()/dst_clone()/dst_use() to see if
dst_hold_safe() is needed to avoid double free issue if dst
gc is removed and dst_release() directly destroys dst when
dst->__refcnt drops to 0.
In tx path, TCP hold sk->sk_rx_dst ref count and also hold sock_lock().
UDP and other similar protocols always hold refcount for
skb->_skb_refdst. So both paths seem to be safe.
In rx path, as it is lockless and skb_dst_set_noref() is likely to be
used, dst_hold_safe() should always be used when trying to hold dst.
In the routing code, if dst is held during an rcu protected session, it
is necessary to call dst_hold_safe() as the current dst might be in its
rcu grace period.
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/route.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index d986d80258d2..903a12c601ac 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -2234,10 +2234,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res, rth = rcu_dereference(*prth); rt_cache: - if (rt_cache_valid(rth)) { - dst_hold(&rth->dst); + if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst)) return rth; - } } add: |