net: tunnels should use rcu_dereference
tunnel4_handlers, tunnel64_handlers, tunnel6_handlers and tunnel46_handlers are protected by RCU, but we dont use appropriate rcu primitives to scan them. rcu_lock() is already held by caller. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
		
				
					committed by
					
						
						David S. Miller
					
				
			
			
				
	
			
			
			
						parent
						
							0642701326
						
					
				
				
					commit
					875168a933
				
			@@ -73,6 +73,11 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family)
 | 
			
		||||
}
 | 
			
		||||
EXPORT_SYMBOL(xfrm4_tunnel_deregister);
 | 
			
		||||
 | 
			
		||||
#define for_each_tunnel_rcu(head, handler)		\
 | 
			
		||||
	for (handler = rcu_dereference(head);		\
 | 
			
		||||
	     handler != NULL;				\
 | 
			
		||||
	     handler = rcu_dereference(handler->next))	\
 | 
			
		||||
	
 | 
			
		||||
static int tunnel4_rcv(struct sk_buff *skb)
 | 
			
		||||
{
 | 
			
		||||
	struct xfrm_tunnel *handler;
 | 
			
		||||
@@ -80,7 +85,7 @@ static int tunnel4_rcv(struct sk_buff *skb)
 | 
			
		||||
	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
 | 
			
		||||
		goto drop;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel4_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel4_handlers, handler)
 | 
			
		||||
		if (!handler->handler(skb))
 | 
			
		||||
			return 0;
 | 
			
		||||
 | 
			
		||||
@@ -99,7 +104,7 @@ static int tunnel64_rcv(struct sk_buff *skb)
 | 
			
		||||
	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 | 
			
		||||
		goto drop;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel64_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel64_handlers, handler)
 | 
			
		||||
		if (!handler->handler(skb))
 | 
			
		||||
			return 0;
 | 
			
		||||
 | 
			
		||||
@@ -115,7 +120,7 @@ static void tunnel4_err(struct sk_buff *skb, u32 info)
 | 
			
		||||
{
 | 
			
		||||
	struct xfrm_tunnel *handler;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel4_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel4_handlers, handler)
 | 
			
		||||
		if (!handler->err_handler(skb, info))
 | 
			
		||||
			break;
 | 
			
		||||
}
 | 
			
		||||
@@ -125,7 +130,7 @@ static void tunnel64_err(struct sk_buff *skb, u32 info)
 | 
			
		||||
{
 | 
			
		||||
	struct xfrm_tunnel *handler;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel64_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel64_handlers, handler)
 | 
			
		||||
		if (!handler->err_handler(skb, info))
 | 
			
		||||
			break;
 | 
			
		||||
}
 | 
			
		||||
 
 | 
			
		||||
@@ -88,6 +88,11 @@ int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 | 
			
		||||
 | 
			
		||||
EXPORT_SYMBOL(xfrm6_tunnel_deregister);
 | 
			
		||||
 | 
			
		||||
#define for_each_tunnel_rcu(head, handler)		\
 | 
			
		||||
	for (handler = rcu_dereference(head);		\
 | 
			
		||||
	     handler != NULL;				\
 | 
			
		||||
	     handler = rcu_dereference(handler->next))	\
 | 
			
		||||
 | 
			
		||||
static int tunnel6_rcv(struct sk_buff *skb)
 | 
			
		||||
{
 | 
			
		||||
	struct xfrm6_tunnel *handler;
 | 
			
		||||
@@ -95,7 +100,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
 | 
			
		||||
	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 | 
			
		||||
		goto drop;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel6_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel6_handlers, handler)
 | 
			
		||||
		if (!handler->handler(skb))
 | 
			
		||||
			return 0;
 | 
			
		||||
 | 
			
		||||
@@ -113,7 +118,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
 | 
			
		||||
	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
 | 
			
		||||
		goto drop;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel46_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel46_handlers, handler)
 | 
			
		||||
		if (!handler->handler(skb))
 | 
			
		||||
			return 0;
 | 
			
		||||
 | 
			
		||||
@@ -129,7 +134,7 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 | 
			
		||||
{
 | 
			
		||||
	struct xfrm6_tunnel *handler;
 | 
			
		||||
 | 
			
		||||
	for (handler = tunnel6_handlers; handler; handler = handler->next)
 | 
			
		||||
	for_each_tunnel_rcu(tunnel6_handlers, handler)
 | 
			
		||||
		if (!handler->err_handler(skb, opt, type, code, offset, info))
 | 
			
		||||
			break;
 | 
			
		||||
}
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user