releases/4.20.17/ipv6-route-enforce-rcu-protection-in-rt6_update_exception_stamp_rt.patch

   1 From foo@baz Thu Mar 14 23:20:15 PDT 2019
   2 From: Paolo Abeni <pabeni@redhat.com>
   3 Date: Thu, 21 Feb 2019 11:19:41 +0100
   4 Subject: ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()
   5
   6 From: Paolo Abeni <pabeni@redhat.com>
   7
   8 [ Upstream commit 193f3685d0546b0cea20c99894aadb70098e47bf ]
   9
  10 We must access rt6_info->from under RCU read lock: move the
  11 dereference under such lock, with proper annotation.
  12
  13 v1 -> v2:
  14  - avoid using multiple, racy, fetch operations for rt->from
  15
  16 Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
  17 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  18 Reviewed-by: David Ahern <dsahern@gmail.com>
  19 Signed-off-by: David S. Miller <davem@davemloft.net>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  net/ipv6/route.c |   11 ++++++-----
  23  1 file changed, 6 insertions(+), 5 deletions(-)
  24
  25 --- a/net/ipv6/route.c
  26 +++ b/net/ipv6/route.c
  27 @@ -1608,15 +1608,15 @@ static int rt6_remove_exception_rt(struc
  28  static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
  29  {
  30         struct rt6_exception_bucket *bucket;
  31 -       struct fib6_info *from = rt->from;
  32         struct in6_addr *src_key = NULL;
  33         struct rt6_exception *rt6_ex;
  34 -
  35 -       if (!from ||
  36 -           !(rt->rt6i_flags & RTF_CACHE))
  37 -               return;
  38 +       struct fib6_info *from;
  39
  40         rcu_read_lock();
  41 +       from = rcu_dereference(rt->from);
  42 +       if (!from || !(rt->rt6i_flags & RTF_CACHE))
  43 +               goto unlock;
  44 +
  45         bucket = rcu_dereference(from->rt6i_exception_bucket);
  46
  47  #ifdef CONFIG_IPV6_SUBTREES
  48 @@ -1635,6 +1635,7 @@ static void rt6_update_exception_stamp_r
  49         if (rt6_ex)
  50                 rt6_ex->stamp = jiffies;
  51
  52 +unlock:
  53         rcu_read_unlock();
  54  }
  55