Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb1d23b0 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

[IPV4]: Bug fix in rt_check_expire() 



- rt_check_expire() fixes (an overflow occured if size of the hash
  was >= 65536)

reminder of the bugfix:

The rt_check_expire() has a serious problem on machines with large
route caches, and a standard HZ value of 1000.

With default values, ie ip_rt_gc_interval = 60*HZ = 60000 ;

the loop count :

     for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;


overflows (t is a 31 bit value) as soon rt_hash_log is >= 16  (65536
slots in route cache hash table).

In this case, rt_check_expire() does nothing at all

Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 424c4b70

net/ipv4/route.c

+14 −7
Original line number Diff line number Diff line
@@ -54,7 +54,7 @@ 
 *		Marc Boucher	:	routing by fwmark

 *	Robert Olsson		:	Added rt_cache statistics

 *	Arnaldo C. Melo		:	Convert proc stuff to seq_file

 *	Eric Dumazet		:	hashed spinlocks

 *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.

 *

 *		This program is free software; you can redistribute it and/or

 *		modify it under the terms of the GNU General Public License
@@ -606,18 +606,25 @@ static struct rtable **rt_remove_balanced_route(struct rtable **chain_head, 
/* This runs via a timer and thus is always in BH context. */

static void rt_check_expire(unsigned long dummy)

{

	static int rover;

	int i = rover, t;

	static unsigned int rover;

	unsigned int i = rover, goal;

	struct rtable *rth, **rthp;

	unsigned long now = jiffies;



	for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;

	     t -= ip_rt_gc_timeout) {

	u64 mult;



	mult = ((u64)ip_rt_gc_interval) << rt_hash_log;

	if (ip_rt_gc_timeout > 1)

		do_div(mult, ip_rt_gc_timeout);

	goal = (unsigned int)mult;

	if (goal > rt_hash_mask) goal = rt_hash_mask + 1;

	for (; goal > 0; goal--) {

		unsigned long tmo = ip_rt_gc_timeout;



		i = (i + 1) & rt_hash_mask;

		rthp = &rt_hash_table[i].chain;



		if (*rthp == 0)

			continue;

		spin_lock(rt_hash_lock_addr(i));

		while ((rth = *rthp) != NULL) {

			if (rth->u.dst.expires) {
@@ -658,7 +665,7 @@ static void rt_check_expire(unsigned long dummy) 
			break;

	}

	rover = i;

	mod_timer(&rt_periodic_timer, now + ip_rt_gc_interval);

	mod_timer(&rt_periodic_timer, jiffies + ip_rt_gc_interval);

}



/* This can run from both BH and non-BH contexts, the latter