Commit c64a0727 authored by Justin Iurman's avatar Justin Iurman Committed by Paolo Abeni
Browse files

net: ipv6: fix dst ref loop on input in seg6 lwt 



Prevent a dst ref loop on input in seg6_iptunnel.

Fixes: af4a2209 ("ipv6: sr: use dst_cache in seg6_input")
Cc: David Lebrun <dlebrun@google.com>
Cc: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Signed-off-by: default avatarJustin Iurman <justin.iurman@uliege.be>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 1cf9631d

net/ipv6/seg6_iptunnel.c

+12 −2
Original line number Diff line number Diff line
@@ -472,10 +472,18 @@ static int seg6_input_core(struct net *net, struct sock *sk, 
{

	struct dst_entry *orig_dst = skb_dst(skb);

	struct dst_entry *dst = NULL;

	struct lwtunnel_state *lwtst;

	struct seg6_lwt *slwt;

	int err;



	slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);

	/* We cannot dereference "orig_dst" once ip6_route_input() or

	 * skb_dst_drop() is called. However, in order to detect a dst loop, we

	 * need the address of its lwtstate. So, save the address of lwtstate

	 * now and use it later as a comparison.

	 */

	lwtst = orig_dst->lwtstate;



	slwt = seg6_lwt_lwtunnel(lwtst);



	local_bh_disable();

	dst = dst_cache_get(&slwt->cache);
@@ -490,7 +498,9 @@ static int seg6_input_core(struct net *net, struct sock *sk, 
	if (!dst) {

		ip6_route_input(skb);

		dst = skb_dst(skb);

		if (!dst->error) {



		/* cache only if we don't create a dst reference loop */

		if (!dst->error && lwtst != dst->lwtstate) {

			local_bh_disable();

			dst_cache_set_ip6(&slwt->cache, dst,

					  &ipv6_hdr(skb)->saddr);