Wei Wang 9df16efadd ipv4: call dst_hold_safe() properly
This patch checks all the calls to
dst_hold()/skb_dst_force()/dst_clone()/dst_use() to see if
dst_hold_safe() is needed to avoid double free issue if dst
gc is removed and dst_release() directly destroys dst when
dst->__refcnt drops to 0.

In tx path, TCP hold sk->sk_rx_dst ref count and also hold sock_lock().
UDP and other similar protocols always hold refcount for
skb->_skb_refdst. So both paths seem to be safe.

In rx path, as it is lockless and skb_dst_set_noref() is likely to be
used, dst_hold_safe() should always be used when trying to hold dst.

In the routing code, if dst is held during an rcu protected session, it
is necessary to call dst_hold_safe() as the current dst might be in its
rcu grace period.

Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-17 22:54:00 -04:00
..
2017-06-04 22:56:55 -04:00
2017-05-21 13:42:36 -04:00
2016-10-20 14:32:22 -04:00
2017-01-13 22:37:16 -05:00
2017-04-30 22:44:04 -04:00
2017-05-08 15:10:31 -04:00
2017-06-15 12:12:40 -04:00
2017-03-24 20:50:28 -07:00
2017-06-17 22:54:00 -04:00
2017-06-15 12:12:40 -04:00
2017-06-15 12:12:40 -04:00
2017-05-21 13:42:36 -04:00
2017-05-24 16:29:57 -04:00
2017-06-15 12:12:40 -04:00
2017-02-15 11:04:11 +01:00
2017-01-10 10:57:12 +01:00