diff options
| author | David Ahern <dsa@cumulusnetworks.com> | 2016-04-07 11:10:06 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-04-11 15:56:20 -0400 |
| commit | 9ab179d83b4e31ea277a123492e419067c2f129a (patch) | |
| tree | d56d2138f40f62e348dd7ac0c0b6a70b4a3b9207 /net/ipv6 | |
| parent | 10c3c02255124e28c8bb63a274a543ee7e77f223 (diff) | |
| download | linux-9ab179d83b4e31ea277a123492e419067c2f129a.tar.gz linux-9ab179d83b4e31ea277a123492e419067c2f129a.tar.bz2 linux-9ab179d83b4e31ea277a123492e419067c2f129a.zip | |
net: vrf: Fix dst reference counting
Vivek reported a kernel exception deleting a VRF with an active
connection through it. The root cause is that the socket has a cached
reference to a dst that is destroyed. Converting the dst_destroy to
dst_release and letting proper reference counting kick in does not
work as the dst has a reference to the device which needs to be released
as well.
I talked to Hannes about this at netdev and he pointed out the ipv4 and
ipv6 dst handling has dst_ifdown for just this scenario. Rather than
continuing with the reinvented dst wheel in VRF just remove it and
leverage the ipv4 and ipv6 versions.
Fixes: 193125dbd8eb2 ("net: Introduce VRF device driver")
Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/route.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index ed446639219c..1d8871a5ed20 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -338,9 +338,9 @@ static struct rt6_info *__ip6_dst_alloc(struct net *net, return rt; } -static struct rt6_info *ip6_dst_alloc(struct net *net, - struct net_device *dev, - int flags) +struct rt6_info *ip6_dst_alloc(struct net *net, + struct net_device *dev, + int flags) { struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags); @@ -364,6 +364,7 @@ static struct rt6_info *ip6_dst_alloc(struct net *net, return rt; } +EXPORT_SYMBOL(ip6_dst_alloc); static void ip6_dst_destroy(struct dst_entry *dst) { |