summaryrefslogtreecommitdiffstats
path: root/net/ipv6/route.c
diff options
context:
space:
mode:
authorWei Wang <weiwan@google.com>2017-10-06 12:06:06 -0700
committerDavid S. Miller <davem@davemloft.net>2017-10-07 21:22:58 +0100
commitd3843fe5fd45be0e04a251a2cc68893c859a31bd (patch)
tree57ebae60cb5df226a1fe21c8655f767eedc41fb7 /net/ipv6/route.c
parent51e398e86d61b69b9a4be49ff7f6afeb87530df1 (diff)
downloadop-kernel-dev-d3843fe5fd45be0e04a251a2cc68893c859a31bd.zip
op-kernel-dev-d3843fe5fd45be0e04a251a2cc68893c859a31bd.tar.gz
ipv6: replace dst_hold() with dst_hold_safe() in routing code
With rwlock, it is safe to call dst_hold() in the read thread because read thread is guaranteed to be separated from write thread. However, after we replace rwlock with rcu, it is no longer safe to use dst_hold(). A dst might already have been deleted but is waiting for the rcu grace period to pass before freeing the memory when a read thread is trying to do dst_hold(). This could potentially cause double free issue. So this commit replaces all dst_hold() with dst_hold_safe() in all read thread to avoid this double free issue. And in order to make the code more compact, a new function ip6_hold_safe() is introduced. It calls dst_hold_safe() first, and if that fails, it will either fall back to hold and return net->ipv6.ip6_null_entry or set rt to NULL according to the caller's need. Signed-off-by: Wei Wang <weiwan@google.com> Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/route.c')
-rw-r--r--net/ipv6/route.c71
1 files changed, 52 insertions, 19 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 941c062..aeb349a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -874,6 +874,23 @@ static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
}
}
+static bool ip6_hold_safe(struct net *net, struct rt6_info **prt,
+ bool null_fallback)
+{
+ struct rt6_info *rt = *prt;
+
+ if (dst_hold_safe(&rt->dst))
+ return true;
+ if (null_fallback) {
+ rt = net->ipv6.ip6_null_entry;
+ dst_hold(&rt->dst);
+ } else {
+ rt = NULL;
+ }
+ *prt = rt;
+ return false;
+}
+
static struct rt6_info *ip6_pol_route_lookup(struct net *net,
struct fib6_table *table,
struct flowi6 *fl6, int flags)
@@ -898,7 +915,9 @@ restart:
if (rt_cache)
rt = rt_cache;
- dst_use(&rt->dst, jiffies);
+ if (ip6_hold_safe(net, &rt, true))
+ dst_use_noref(&rt->dst, jiffies);
+
read_unlock_bh(&table->tb6_lock);
trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
@@ -1061,10 +1080,9 @@ static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
p = this_cpu_ptr(rt->rt6i_pcpu);
pcpu_rt = *p;
- if (pcpu_rt) {
- dst_hold(&pcpu_rt->dst);
+ if (pcpu_rt && ip6_hold_safe(NULL, &pcpu_rt, false))
rt6_dst_from_metrics_check(pcpu_rt);
- }
+
return pcpu_rt;
}
@@ -1625,12 +1643,17 @@ redo_rt6_select:
if (rt_cache)
rt = rt_cache;
- if (rt == net->ipv6.ip6_null_entry || (rt->rt6i_flags & RTF_CACHE)) {
- dst_use(&rt->dst, jiffies);
+ if (rt == net->ipv6.ip6_null_entry) {
+ read_unlock_bh(&table->tb6_lock);
+ dst_hold(&rt->dst);
+ trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
+ return rt;
+ } else if (rt->rt6i_flags & RTF_CACHE) {
+ if (ip6_hold_safe(net, &rt, true)) {
+ dst_use_noref(&rt->dst, jiffies);
+ rt6_dst_from_metrics_check(rt);
+ }
read_unlock_bh(&table->tb6_lock);
-
- rt6_dst_from_metrics_check(rt);
-
trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
return rt;
} else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
@@ -1643,7 +1666,13 @@ redo_rt6_select:
struct rt6_info *uncached_rt;
- dst_use(&rt->dst, jiffies);
+ if (ip6_hold_safe(net, &rt, true)) {
+ dst_use_noref(&rt->dst, jiffies);
+ } else {
+ read_unlock_bh(&table->tb6_lock);
+ uncached_rt = rt;
+ goto uncached_rt_out;
+ }
read_unlock_bh(&table->tb6_lock);
uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL);
@@ -1659,6 +1688,7 @@ redo_rt6_select:
dst_hold(&uncached_rt->dst);
}
+uncached_rt_out:
trace_fib6_table_lookup(net, uncached_rt, table->tb6_id, fl6);
return uncached_rt;
@@ -1667,8 +1697,7 @@ redo_rt6_select:
struct rt6_info *pcpu_rt;
- rt->dst.lastuse = jiffies;
- rt->dst.__use++;
+ dst_use_noref(&rt->dst, jiffies);
pcpu_rt = rt6_get_pcpu_route(rt);
if (pcpu_rt) {
@@ -2130,7 +2159,7 @@ restart:
}
out:
- dst_hold(&rt->dst);
+ ip6_hold_safe(net, &rt, true);
read_unlock_bh(&table->tb6_lock);
@@ -2841,7 +2870,8 @@ static int ip6_route_del(struct fib6_config *cfg,
continue;
if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
continue;
- dst_hold(&rt->dst);
+ if (!dst_hold_safe(&rt->dst))
+ break;
read_unlock_bh(&table->tb6_lock);
/* if gateway was specified only delete the one hop */
@@ -3038,7 +3068,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
continue;
if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
continue;
- dst_hold(&rt->dst);
+ ip6_hold_safe(NULL, &rt, false);
break;
}
out:
@@ -3096,7 +3126,7 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
break;
}
if (rt)
- dst_hold(&rt->dst);
+ ip6_hold_safe(NULL, &rt, false);
read_unlock_bh(&table->tb6_lock);
return rt;
}
@@ -3139,9 +3169,12 @@ restart:
for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
(!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
- dst_hold(&rt->dst);
- read_unlock_bh(&table->tb6_lock);
- ip6_del_rt(rt);
+ if (dst_hold_safe(&rt->dst)) {
+ read_unlock_bh(&table->tb6_lock);
+ ip6_del_rt(rt);
+ } else {
+ read_unlock_bh(&table->tb6_lock);
+ }
goto restart;
}
}
OpenPOWER on IntegriCloud