Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf71d2bc authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by David S. Miller
Browse files

sit: fix panic with route cache in ip tunnels 



Bug introduced by commit 7d442fab ("ipv4: Cache dst in tunnels").

Because sit code does not call ip_tunnel_init(), the dst_cache was not
initialized.

CC: Tom Herbert <therbert@google.com>
Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6671b224

include/net/ip_tunnels.h

+1 −0
Original line number Diff line number Diff line
@@ -129,6 +129,7 @@ int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[], 
int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],

		      struct ip_tunnel_parm *p);

void ip_tunnel_setup(struct net_device *dev, int net_id);

void ip_tunnel_dst_reset_all(struct ip_tunnel *t);



/* Extract dsfield from inner protocol */

static inline u8 ip_tunnel_get_dsfield(const struct iphdr *iph,

net/ipv4/ip_tunnel.c

+4 −3
Original line number Diff line number Diff line
@@ -93,13 +93,14 @@ static void tunnel_dst_reset(struct ip_tunnel *t) 
	tunnel_dst_set(t, NULL);

}



static void tunnel_dst_reset_all(struct ip_tunnel *t)

void ip_tunnel_dst_reset_all(struct ip_tunnel *t)

{

	int i;



	for_each_possible_cpu(i)

		__tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);

}

EXPORT_SYMBOL(ip_tunnel_dst_reset_all);



static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)

{
@@ -713,7 +714,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn, 
		if (set_mtu)

			dev->mtu = mtu;

	}

	tunnel_dst_reset_all(t);

	ip_tunnel_dst_reset_all(t);

	netdev_state_change(dev);

}
@@ -1042,7 +1043,7 @@ void ip_tunnel_uninit(struct net_device *dev) 
	if (itn->fb_tunnel_dev != dev)

		ip_tunnel_del(netdev_priv(dev));



	tunnel_dst_reset_all(tunnel);

	ip_tunnel_dst_reset_all(tunnel);

}

EXPORT_SYMBOL_GPL(ip_tunnel_uninit);

net/ipv6/sit.c

+19 −0
Original line number Diff line number Diff line
@@ -475,6 +475,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev) 
		ipip6_tunnel_unlink(sitn, tunnel);

		ipip6_tunnel_del_prl(tunnel, NULL);

	}

	ip_tunnel_dst_reset_all(tunnel);

	dev_put(dev);

}
@@ -1082,6 +1083,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p) 
		t->parms.link = p->link;

		ipip6_tunnel_bind_dev(t->dev);

	}

	ip_tunnel_dst_reset_all(t);

	netdev_state_change(t->dev);

}
@@ -1112,6 +1114,7 @@ static int ipip6_tunnel_update_6rd(struct ip_tunnel *t, 
	t->ip6rd.relay_prefix = relay_prefix;

	t->ip6rd.prefixlen = ip6rd->prefixlen;

	t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;

	ip_tunnel_dst_reset_all(t);

	netdev_state_change(t->dev);

	return 0;

}
@@ -1271,6 +1274,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) 
			err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);

			break;

		}

		ip_tunnel_dst_reset_all(t);

		netdev_state_change(dev);

		break;
@@ -1326,6 +1330,9 @@ static const struct net_device_ops ipip6_netdev_ops = { 


static void ipip6_dev_free(struct net_device *dev)

{

	struct ip_tunnel *tunnel = netdev_priv(dev);



	free_percpu(tunnel->dst_cache);

	free_percpu(dev->tstats);

	free_netdev(dev);

}
@@ -1375,6 +1382,12 @@ static int ipip6_tunnel_init(struct net_device *dev) 
		u64_stats_init(&ipip6_tunnel_stats->syncp);

	}



	tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);

	if (!tunnel->dst_cache) {

		free_percpu(dev->tstats);

		return -ENOMEM;

	}



	return 0;

}
@@ -1405,6 +1418,12 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev) 
		u64_stats_init(&ipip6_fb_stats->syncp);

	}



	tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);

	if (!tunnel->dst_cache) {

		free_percpu(dev->tstats);

		return -ENOMEM;

	}



	dev_hold(dev);

	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);

	return 0;