Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit caa41527 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv4: fix a race in update_or_create_fnhe() 



nh_exceptions is effectively used under rcu, but lacks proper
barriers. Between kzalloc() and setting of nh->nh_exceptions(),
we need a proper memory barrier.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Fixes: 4895c771 ("ipv4: Add FIB nexthop exceptions.")
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 29abe2fd

include/net/ip_fib.h

+1 −1
Original line number Diff line number Diff line
@@ -87,7 +87,7 @@ struct fib_nh { 
	int			nh_saddr_genid;

	struct rtable __rcu * __percpu *nh_pcpu_rth_output;

	struct rtable __rcu	*nh_rth_input;

	struct fnhe_hash_bucket	*nh_exceptions;

	struct fnhe_hash_bucket	__rcu *nh_exceptions;

};



/*

net/ipv4/fib_semantics.c

+5 −3
Original line number Diff line number Diff line
@@ -157,9 +157,12 @@ static void rt_fibinfo_free(struct rtable __rcu **rtp) 


static void free_nh_exceptions(struct fib_nh *nh)

{

	struct fnhe_hash_bucket *hash = nh->nh_exceptions;

	struct fnhe_hash_bucket *hash;

	int i;



	hash = rcu_dereference_protected(nh->nh_exceptions, 1);

	if (!hash)

		return;

	for (i = 0; i < FNHE_HASH_SIZE; i++) {

		struct fib_nh_exception *fnhe;
@@ -205,7 +208,6 @@ static void free_fib_info_rcu(struct rcu_head *head) 
	change_nexthops(fi) {

		if (nexthop_nh->nh_dev)

			dev_put(nexthop_nh->nh_dev);

		if (nexthop_nh->nh_exceptions)

		free_nh_exceptions(nexthop_nh);

		rt_fibinfo_free_cpus(nexthop_nh->nh_pcpu_rth_output);

		rt_fibinfo_free(&nexthop_nh->nh_rth_input);

net/ipv4/route.c

+3 −3
Original line number Diff line number Diff line
@@ -628,12 +628,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, 


	spin_lock_bh(&fnhe_lock);



	hash = nh->nh_exceptions;

	hash = rcu_dereference(nh->nh_exceptions);

	if (!hash) {

		hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);

		if (!hash)

			goto out_unlock;

		nh->nh_exceptions = hash;

		rcu_assign_pointer(nh->nh_exceptions, hash);

	}



	hash += hval;
@@ -1242,7 +1242,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) 


static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)

{

	struct fnhe_hash_bucket *hash = nh->nh_exceptions;

	struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);

	struct fib_nh_exception *fnhe;

	u32 hval;