Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55432d2b authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

inetpeer: fix a race in inetpeer_gc_worker() 



commit 5faa5df1 (inetpeer: Invalidate the inetpeer tree along with
the routing cache) added a race :

Before freeing an inetpeer, we must respect a RCU grace period, and make
sure no user will attempt to increase refcnt.

inetpeer_invalidate_tree() waits for a RCU grace period before inserting
inetpeer tree into gc_list and waking the worker. At that time, no
concurrent lookup can find a inetpeer in this tree.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dd03cff2

include/net/inetpeer.h

+4 −1
Original line number Diff line number Diff line
@@ -40,7 +40,10 @@ struct inet_peer { 
	u32			pmtu_orig;

	u32			pmtu_learned;

	struct inetpeer_addr_base redirect_learned;

	union {

		struct list_head	gc_list;

		struct rcu_head     gc_rcu;

	};

	/*

	 * Once inet_peer is queued for deletion (refcnt == -1), following fields

	 * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp

net/ipv4/inetpeer.c

+12 −4
Original line number Diff line number Diff line
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout) 
}

EXPORT_SYMBOL(inet_peer_xrlim_allow);



static void inetpeer_inval_rcu(struct rcu_head *head)

{

	struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);



	spin_lock_bh(&gc_lock);

	list_add_tail(&p->gc_list, &gc_list);

	spin_unlock_bh(&gc_lock);



	schedule_delayed_work(&gc_work, gc_delay);

}



void inetpeer_invalidate_tree(int family)

{

	struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family) 
	prev = cmpxchg(&base->root, old, new);

	if (prev == old) {

		base->total = 0;

		spin_lock(&gc_lock);

		list_add_tail(&prev->gc_list, &gc_list);

		spin_unlock(&gc_lock);

		schedule_delayed_work(&gc_work, gc_delay);

		call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);

	}



out: