diff options
| author | Wei Wang <weiwan@google.com> | 2017-06-17 10:42:35 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-06-17 22:54:00 -0400 |
| commit | ad65a2f05695aced349e308193c6e2a6b1d87112 (patch) | |
| tree | bc94ee3f9f25c990ffd1c8367a9c081289648c27 /net/ipv6/route.c | |
| parent | 9514528d92d4cbe086499322370155ed69f5d06c (diff) | |
| download | op-kernel-dev-ad65a2f05695aced349e308193c6e2a6b1d87112.zip op-kernel-dev-ad65a2f05695aced349e308193c6e2a6b1d87112.tar.gz | |
ipv6: call dst_hold_safe() properly
Similar as ipv4, ipv6 path also needs to call dst_hold_safe() when
necessary to avoid double free issue on the dst.
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/route.c')
| -rw-r--r-- | net/ipv6/route.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 908b711..c52c519 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1366,8 +1366,8 @@ static void ip6_link_failure(struct sk_buff *skb) rt = (struct rt6_info *) skb_dst(skb); if (rt) { if (rt->rt6i_flags & RTF_CACHE) { - dst_hold(&rt->dst); - ip6_del_rt(rt); + if (dst_hold_safe(&rt->dst)) + ip6_del_rt(rt); } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) { rt->rt6i_node->fn_sernum = -1; } |
