diff options
| author | Eric Dumazet <edumazet@google.com> | 2024-05-31 13:26:35 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-06-03 18:50:09 -0700 |
| commit | cf28ff8e4c02e1ffa850755288ac954b6ff0db8c (patch) | |
| tree | 89f3d6c9ecedbc77668983cdb86011501da72aa5 /net/ipv6/ila | |
| parent | c0b98ac1cc104f48763cdb27b1e9ac25fd81fc90 (diff) | |
| download | linux-cf28ff8e4c02e1ffa850755288ac954b6ff0db8c.tar.gz linux-cf28ff8e4c02e1ffa850755288ac954b6ff0db8c.tar.bz2 linux-cf28ff8e4c02e1ffa850755288ac954b6ff0db8c.zip | |
ila: block BH in ila_output()
As explained in commit 1378817486d6 ("tipc: block BH
before using dst_cache"), net/core/dst_cache.c
helpers need to be called with BH disabled.
ila_output() is called from lwtunnel_output()
possibly from process context, and under rcu_read_lock().
We might be interrupted by a softirq, re-enter ila_output()
and corrupt dst_cache data structures.
Fix the race by using local_bh_disable().
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/20240531132636.2637995-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/ipv6/ila')
| -rw-r--r-- | net/ipv6/ila/ila_lwt.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c index 0601bad79822..ff7e734e335b 100644 --- a/net/ipv6/ila/ila_lwt.c +++ b/net/ipv6/ila/ila_lwt.c @@ -58,7 +58,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) return orig_dst->lwtstate->orig_output(net, sk, skb); } + local_bh_disable(); dst = dst_cache_get(&ilwt->dst_cache); + local_bh_enable(); if (unlikely(!dst)) { struct ipv6hdr *ip6h = ipv6_hdr(skb); struct flowi6 fl6; @@ -86,8 +88,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) goto drop; } - if (ilwt->connected) + if (ilwt->connected) { + local_bh_disable(); dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr); + local_bh_enable(); + } } skb_dst_set(skb, dst); |