diff options
| author | David S. Miller <davem@davemloft.net> | 2012-05-10 22:16:32 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-05-10 22:16:32 -0400 |
| commit | dccd9ecc374462e5d6a5b8f8110415a86c2213d8 (patch) | |
| tree | 92985101d752308885e7b29678dc9845eabea0d6 | |
| parent | 0e0c55165b638e96c8d7097ea638aa368daa268a (diff) | |
| download | linux-dccd9ecc374462e5d6a5b8f8110415a86c2213d8.tar.gz linux-dccd9ecc374462e5d6a5b8f8110415a86c2213d8.tar.bz2 linux-dccd9ecc374462e5d6a5b8f8110415a86c2213d8.zip | |
ipv4: Do not use dead fib_info entries.
Due to RCU lookups and RCU based release, fib_info objects can
be found during lookup which have fi->fib_dead set.
We must ignore these entries, otherwise we risk dereferencing
the parts of the entry which are being torn down.
Reported-by: Yevgen Pronenko <yevgen.pronenko@sonymobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/fib_trie.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index bce36f1a37b4..30b88d7b4bd6 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1370,6 +1370,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l, if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos) continue; + if (fi->fib_dead) + continue; if (fa->fa_info->fib_scope < flp->flowi4_scope) continue; fib_alias_accessed(fa); |