shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-03 01:36:52 +09:00
Code Issues Packages Projects Releases Wiki Activity

net: fix NULL dereferences in check_peer_redir()

Browse Source 
[ Upstream commit d3aaeb38c4, along
  with dependent backports of commits:
     69cce1d140
     9de79c127c
     218fa90f07
     580da35a31
     f7e57044ee
     e049f28883 ]

Gergely Kalman reported crashes in check_peer_redir().

It appears commit f39925dbde (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.

Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.

Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.

As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)

Many thanks to Gergely for providing a pretty report pointing to the
bug.

Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eric Dumazet
2012-02-09 16:13:19 -05:00
committed by Greg Kroah-Hartman
parent 323a479328
commit 8a533666d1
32 changed files with 358 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/arp.h
View File

@@ -16,6 +16,7 @@ extern void arp_send(int type, int ptype, __be32 dest_ip,
const unsigned char *dest_hw,
const unsigned char *src_hw, const unsigned char *th);
extern int arp_bind_neighbour(struct dst_entry *dst);
extern struct neighbour *__arp_bind_neighbour(struct dst_entry *dst, __be32 nexthop);
extern int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir);
extern void arp_ifdown(struct net_device *dev);

27
include/net/dst.h
View File

@@ -37,7 +37,7 @@ struct dst_entry {
unsigned long _metrics;
unsigned long expires;
struct dst_entry *path;
struct neighbour *neighbour;
struct neighbour __rcu *_neighbour;
struct hh_cache *hh;
#ifdef CONFIG_XFRM
struct xfrm_state *xfrm;
@@ -86,6 +86,21 @@ struct dst_entry {
};
};
static inline struct neighbour *dst_get_neighbour(struct dst_entry *dst)
{
return rcu_dereference(dst->_neighbour);
}
static inline struct neighbour *dst_get_neighbour_raw(struct dst_entry *dst)
{
return rcu_dereference_raw(dst->_neighbour);
}
static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
{
rcu_assign_pointer(dst->_neighbour, neigh);
}
extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
extern const u32 dst_default_metrics[RTAX_MAX];
@@ -371,8 +386,14 @@ static inline void dst_rcu_free(struct rcu_head *head)
static inline void dst_confirm(struct dst_entry *dst)
{
if (dst)
neigh_confirm(dst->neighbour);
if (dst) {
struct neighbour *n;
rcu_read_lock();
n = dst_get_neighbour(dst);
neigh_confirm(n);
rcu_read_unlock();
}
}
static inline void dst_link_failure(struct sk_buff *skb)