[IPV6] Close small race in ip6_del_rt

[IPV6] Close small race in ip6_del_rt

[Herbert Xu]

[-- Attachment #1: Type: text/plain, Size: 399 bytes --]

Hi:

There is a small SMP race in ip6_del_rt where we maybe dereferencing a dst
that has been freed.  This patch fixes it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[-- Attachment #2: p --]
[-- Type: text/plain, Size: 355 bytes --]

===== net/ipv6/route.c 1.99 vs edited =====
--- 1.99/net/ipv6/route.c	2004-10-26 14:27:49 +10:00
+++ edited/net/ipv6/route.c	2004-11-06 16:40:11 +11:00
@@ -979,9 +979,9 @@
 
 	rt6_reset_dflt_pointer(NULL);
 
+	err = fib6_del(rt, nlh, _rtattr);
 	dst_release(&rt->u.dst);
 
-	err = fib6_del(rt, nlh, _rtattr);
 	write_unlock_bh(&rt6_lock);
 
 	return err;

Re: [IPV6] Close small race in ip6_del_rt

[David S. Miller]

On Sat, 6 Nov 2004 21:34:49 +1100
Herbert Xu <herbert@gondor.apana.org.au> wrote:

> There is a small SMP race in ip6_del_rt where we maybe dereferencing a dst
> that has been freed.  This patch fixes it.

Looks good, applied.  Thanks.

There are certain routines, such as fib6_add() and fib_del()
for which it would be nice to have dst/rt refcounting
descriptions in comments.  Then we could:

1) Verify they actually provide that behavior.
2) Make sure callers handle this behavior properly.

I mention this because I had to read the entirety of
fib6_add() to verify some dst refcounting code paths
in the ipv6 stack last week.