From: Eric Dumazet <edumazet@google.com>
Date: Tue, 24 Jun 2014 17:05:11 +0000 (-0700)
Subject: ipv4: fix dst race in sk_dst_get()
X-Git-Tag: omap-for-v3.16/fixes-rc4~53^2~1
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f88649721268999bdff09777847080a52004f691;p=pandora-kernel.git

ipv4: fix dst race in sk_dst_get()

When IP route cache had been removed in linux-3.6, we broke assumption
that dst entries were all freed after rcu grace period. DST_NOCACHE
dst were supposed to be freed from dst_release(). But it appears
we want to keep such dst around, either in UDP sockets or tunnels.

In sk_dst_get() we need to make sure dst refcount is not 0
before incrementing it, or else we might end up freeing a dst
twice.

DST_NOCACHE set on a dst does not mean this dst can not be attached
to a socket or a tunnel.

Then, before actual freeing, we need to observe a rcu grace period
to make sure all other cpus can catch the fact the dst is no longer
usable.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dormando <dormando@rydia.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed