linux/include
YOSHIFUJI Hideaki / 吉藤英明 ecd9883724 ipv6: fix race condition regarding dst->expires and dst->from.
Eric Dumazet wrote:
| Some strange crashes happen in rt6_check_expired(), with access
| to random addresses.
|
| At first glance, it looks like the RTF_EXPIRES and
| stuff added in commit 1716a96101
| (ipv6: fix problem with expired dst cache)
| are racy : same dst could be manipulated at the same time
| on different cpus.
|
| At some point, our stack believes rt->dst.from contains a dst pointer,
| while its really a jiffie value (as rt->dst.expires shares the same area
| of memory)
|
| rt6_update_expires() should be fixed, or am I missing something ?
|
| CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060

Because we do not have any locks for dst_entry, we cannot change
essential structure in the entry; e.g., we cannot change reference
to other entity.

To fix this issue, split 'from' and 'expires' field in dst_entry
out of union.  Once it is 'from' is assigned in the constructor,
keep the reference until the very last stage of the life time of
the object.

Of course, it is unsafe to change 'from', so make rt6_set_from simple
just for fresh entries.

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: Neil Horman <nhorman@tuxdriver.com>
CC: Gao Feng <gaofeng@cn.fujitsu.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reported-by: Steinar H. Gunderson <sesse@google.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-02-20 15:11:45 -05:00
..
acpi PCI changes for the v3.8 merge window: 2012-12-13 12:14:47 -08:00
asm-generic Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2013-01-23 13:31:15 -08:00
clocksource
crypto crypto: cast5/cast6 - move lookup tables to shared module 2012-12-06 17:16:26 +08:00
drm Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel 2013-01-11 07:52:48 +10:00
keys
linux net: fix a build failure when !CONFIG_PROC_FS 2013-02-19 13:18:13 -05:00
math-emu
media [media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface 2012-11-28 09:43:34 -02:00
memory
misc
net ipv6: fix race condition regarding dst->expires and dst->from. 2013-02-20 15:11:45 -05:00
pcmcia
ras
rdma UAPI: Remove empty Kbuild files 2013-01-02 17:36:10 -08:00
rxrpc
scsi SCSI misc on 20121212 2012-12-13 19:20:31 -08:00
sound Merge remote-tracking branch 'asoc/fix/cs4271' into tmp 2013-01-10 12:22:11 +00:00
target target: Introduce TCM_NO_SENSE 2013-01-10 20:06:08 -08:00
trace Various bug fixes for ext4. Perhaps the most serious bug fixed is one 2013-01-02 09:57:34 -08:00
uapi Merge branch 'master' of git://1984.lsi.us.es/nf-next 2013-02-18 23:42:09 -05:00
video Merge branch 'omap-for-v3.8/fixes-for-merge-window' into omap-for-v3.8/fixes-for-merge-window-v2 2012-12-16 11:28:10 -08:00
xen Bugfixes: 2012-12-18 12:26:54 -08:00
Kbuild UAPI: Remove empty Kbuild files 2013-01-02 17:36:10 -08:00