summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2015-11-09 17:51:23 -0800
committerJiri Slaby <jslaby@suse.cz>2015-11-14 17:29:48 +0100
commite98b2397a2181f4d066342beb6a220e43c404e44 (patch)
tree03f1ca775e97329d8c581c5e2555ebefcaab5d4d
parent6651ab3cd17428ac02a53a2f0e90f089a203f03c (diff)
net: fix a race in dst_release()
[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ] Only cpu seeing dst refcount going to 0 can safely dereference dst->flags. Otherwise an other cpu might already have freed the dst. Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") Reported-by: Greg Thelen <gthelen@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
-rw-r--r--net/core/dst.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/dst.c b/net/core/dst.c
index 15b6792e6ebb..c07070544e3f 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -283,7 +283,7 @@ void dst_release(struct dst_entry *dst)
newrefcnt = atomic_dec_return(&dst->__refcnt);
WARN_ON(newrefcnt < 0);
- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+ if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
call_rcu(&dst->rcu_head, dst_destroy_rcu);
}
}