diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2011-07-29 23:00:53 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-08-03 14:34:12 +0400 |
| commit | f2c31e32b378a6653f8de606149d963baf11d7d3 (patch) | |
| tree | 4eeb8075a93520935381a75514f309228e6824c0 /net/ipv4/ip_output.c | |
| parent | 28f4881cbf9ce285edfc245a8990af36d21c062f (diff) | |
| download | linux-f2c31e32b378a6653f8de606149d963baf11d7d3.tar.xz | |
net: fix NULL dereferences in check_peer_redir()
Gergely Kalman reported crashes in check_peer_redir().
It appears commit f39925dbde778 (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.
Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.
Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.
As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)
Many thanks to Gergely for providing a pretty report pointing to the
bug.
Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_output.c')
| -rw-r--r-- | net/ipv4/ip_output.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index ccaaa851ab42..77d3eded665a 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -204,9 +204,15 @@ static inline int ip_finish_output2(struct sk_buff *skb) skb = skb2; } + rcu_read_lock(); neigh = dst_get_neighbour(dst); - if (neigh) - return neigh_output(neigh, skb); + if (neigh) { + int res = neigh_output(neigh, skb); + + rcu_read_unlock(); + return res; + } + rcu_read_unlock(); if (net_ratelimit()) printk(KERN_DEBUG "ip_finish_output2: No header cache and no neighbour!\n"); |