Groups > linux.kernel > #1282037

[PATCH 3.19.y-ckt 020/164] net: fix a race in dst_release()

Path	csiph.com!au2pb.net!2.us.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!nntpspool01.opticnetworks.net!aioe.org!bofh.it!news.nic.it!robomod
From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 020/164] net: fix a race in dst_release()
Date	Wed, 02 Dec 2015 18:10:03 +0100
Message-ID	<qBj4L-1FO-35@gated-at.bofh.it> (permalink)
References	<qBj4K-1FO-3@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com
X-Mailer	git-send-email 1.9.1
X-Extended-Stable	3.19
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	43
Organization	linux.* mail to news gateway
X-Original-Cc	Eric Dumazet <edumazet@google.com>, "David S. Miller" <davem@davemloft.net>, Kamal Mostafa <kamal@canonical.com>
X-Original-Date	Wed, 2 Dec 2015 08:57:51 -0800
X-Original-Message-ID	<1449075615-20754-21-git-send-email-kamal@canonical.com>
X-Original-References	<1449075615-20754-1-git-send-email-kamal@canonical.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1282037

Show key headers only | View raw

3.19.8-ckt11 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ]

Only cpu seeing dst refcount going to 0 can safely
dereference dst->flags.

Otherwise an other cpu might already have freed the dst.

Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/core/dst.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/dst.c b/net/core/dst.c
index e956ce6..f8db403 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -285,7 +285,7 @@ void dst_release(struct dst_entry *dst)
 
 		newrefcnt = atomic_dec_return(&dst->__refcnt);
 		WARN_ON(newrefcnt < 0);
-		if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+		if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
 			call_rcu(&dst->rcu_head, dst_destroy_rcu);
 	}
 }
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.19.y-ckt 020/164] net: fix a race in dst_release() Kamal Mostafa <kamal@canonical.com> - 2015-12-02 18:10 +0100

csiph-web