Commit 6775cab9 authored Apr 16, 2005 by Herbert Xu Committed by Linus Torvalds Apr 16, 2005

[PATCH] Fix dst_destroy() race



When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.

In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 2a278051

net/core/dst.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -198,13 +198,15 @@ struct dst_entry dst_destroy(struct dst_entry dst)

		dst = child;
		if (dst) {
		int nohash = dst->flags & DST_NOHASH;

		if (atomic_dec_and_test(&dst->__refcnt)) {
		/* We were real parent of this dst, so kill child. */
		if (dst->flags&DST_NOHASH)
		if (nohash)
		goto again;
		} else {
		/* Child is still referenced, return it for freeing. */
		if (dst->flags&DST_NOHASH)
		if (nohash)
		return dst;
		/* Child is still in his hash table */
		}