Eric Dumazet 5037e9ef94 net: fix IP early demux races ... David Wilder reported crashes caused by dst reuse. <quote David> I am seeing a crash on a distro V4.2.3 kernel caused by a double release of a dst_entry. In ipv4_dst_destroy() the call to list_empty() finds a poisoned next pointer, indicating the dst_entry has already been removed from the list and freed. The crash occurs 18 to 24 hours into a run of a network stress exerciser. </quote> Thanks to his detailed report and analysis, we were able to understand the core issue. IP early demux can associate a dst to skb, after a lookup in TCP/UDP sockets. When socket cache is not properly set, we want to store into sk->sk_dst_cache the dst for future IP early demux lookups, by acquiring a stable refcount on the dst. Problem is this acquisition is simply using an atomic_inc(), which works well, unless the dst was queued for destruction from dst_release() noticing dst refcount went to zero, if DST_NOCACHE was set on dst. We need to make sure current refcount is not zero before incrementing it, or risk double free as David reported. This patch, being a stable candidate, adds two new helpers, and use them only from IP early demux problematic paths. It might be possible to merge in net-next skb_dst_force() and skb_dst_force_safe(), but I prefer having the smallest patch for stable kernels : Maybe some skb_dst_force() callers do not expect skb->dst can suddenly be cleared. Can probably be backported back to linux-3.6 kernels Reported-by: David J. Wilder <dwilder@us.ibm.com> Tested-by: David J. Wilder <dwilder@us.ibm.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-12-14 23:52:00 -05:00
..
9p
bluetooth	Bluetooth: L2CAP: Fix returning correct LE CoC response codes	2015-11-05 04:04:00 +01:00
caif
irda
iucv	s390/iucv: do not use arrays as argument	2015-09-21 16:03:04 -07:00
netfilter	netfilter: nf_tables: add clone interface to expression operations	2015-11-10 23:47:32 +01:00
netns	Revert "ipv4/icmp: redirect messages can use the ingress daddr as source"	2015-10-14 06:01:07 -07:00
nfc	NFC: nci: non-static functions can not be inline	2015-10-28 06:44:45 +01:00
phonet
sctp	sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING	2015-12-06 22:31:51 -05:00
tc_act	act_connmark: Remember the struct net instead of guessing it.	2015-09-18 21:59:31 +02:00
6lowpan.h	6lowpan: remove lowpan_is_addr_broadcast	2015-10-21 00:49:25 +02:00
act_api.h	net_sched: make tcf_hash_destroy() static	2015-08-26 11:01:44 -07:00
addrconf.h	ipv6: remove unused neigh parameter from ndisc functions	2015-09-24 12:26:08 -07:00
af_ieee802154.h	ieee802154: af_ieee802154: fix typo in comment.	2015-09-17 13:20:05 +02:00
af_rxrpc.h
af_unix.h	unix: avoid use-after-free in ep_remove_wait_queue	2015-11-23 12:29:58 -05:00
af_vsock.h	VSOCK: define VSOCK_SS_LISTEN once only	2015-11-01 12:14:47 -05:00
ah.h
arp.h
atmclip.h
ax25.h	ax25: Stop using sock->sk_protinfo.	2015-06-28 16:55:44 -07:00
ax88796.h
bond_3ad.h	bonding: simplify / unify event handling code for 3ad mode.	2015-11-02 22:52:24 -05:00
bond_alb.h
bond_options.h	bonding: convert num_grat_arp to the new bonding option API	2015-07-27 01:05:24 -07:00
bonding.h	net/bonding: Export bond_option_active_slave_get_rcu	2015-08-30 18:08:50 -04:00
busy_poll.h
cfg80211-wext.h
cfg80211.h	cfg80211/mac80211: clarify RSSI CQM reporting requirements	2015-11-03 10:54:58 +01:00
cfg802154.h	nl802154: add support for security layer	2015-09-30 13:16:44 +02:00
checksum.h	net: Add inet_proto_csum_replace_by_diff utility function	2015-08-17 21:33:06 -07:00
cipso_ipv4.h
cls_cgroup.h	cls_cgroup: factor out classid retrieval	2015-07-20 12:41:30 -07:00
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
dn_dev.h
dn_fib.h
dn_neigh.h	netfilter: Pass net into okfn	2015-09-17 17:18:37 -07:00
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: use switchdev obj for VLAN add/del ops	2015-11-01 15:56:11 -05:00
dsfield.h
dst_metadata.h	tun_dst: Fix potential NULL dereference	2015-11-04 21:59:22 -05:00
dst_ops.h	ipv4, ipv6: Pass net into __ip_local_out and __ip6_local_out	2015-10-08 04:27:02 -07:00
dst.h	net: fix IP early demux races	2015-12-14 23:52:00 -05:00
esp.h
ethoc.h	net/ethoc: support big-endian register layout	2015-09-23 15:33:15 -07:00
fib_rules.h	net: ipv6: use common fib_default_rule_pref	2015-09-09 14:19:50 -07:00
firewire.h
flow_dissector.h	flow_dissector: Don't use bit fields.	2015-09-01 16:46:08 -07:00
flow.h	net: Rename FLOWI_FLAG_VRFSRC to FLOWI_FLAG_L3MDEV_SRC	2015-10-07 04:27:42 -07:00
flowcache.h
fou.h
garp.h
gen_stats.h
genetlink.h	genetlink: simplify genl_notify	2015-09-24 12:25:23 -07:00
geneve.h	geneve: Consolidate Geneve functionality in single module.	2015-08-27 15:42:48 -07:00
gre.h	gre: Remove support for sharing GRE protocol hook.	2015-08-10 14:03:54 -07:00
gro_cells.h	gro_cells: remove spinlock protecting receive queues	2015-08-31 15:17:17 -07:00
gue.h
icmp.h
ieee80211_radiotap.h
ieee802154_netdev.h	nl802154: add support for security layer	2015-09-30 13:16:44 +02:00
if_inet6.h
inet6_connection_sock.h	ipv6: remove obsolete inet6 functions	2015-10-03 04:32:42 -07:00
inet6_hashtables.h
inet_common.h	net: avoid NULL deref in inet_ctl_sock_destroy()	2015-11-02 22:46:09 -05:00
inet_connection_sock.h	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
inet_ecn.h
inet_frag.h	net: fix percpu memory leaks	2015-11-02 22:47:14 -05:00
inet_hashtables.h	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
inet_sock.h	xfrm: take care of request sockets	2015-12-07 17:07:33 -05:00
inet_timewait_sock.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-20 06:08:27 -07:00
inetpeer.h	net: Add support for VRFs to inetpeer cache	2015-08-28 13:32:36 -07:00
ip6_checksum.h
ip6_fib.h	ipv6: Check rt->dst.from for the DST_NOCACHE route	2015-11-15 17:12:37 -05:00
ip6_route.h	ipv6: kill sk_dst_lock	2015-12-03 11:32:06 -05:00
ip6_tunnel.h	ip_tunnel: disable preemption when updating per-cpu tstats	2015-11-16 14:14:32 -05:00
ip_fib.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-11-03 13:41:45 -05:00
ip_tunnels.h	ip_tunnel: disable preemption when updating per-cpu tstats	2015-11-16 14:14:32 -05:00
ip_vs.h	ipvs: Remove skb_sknet	2015-09-24 09:34:43 +09:00
ip.h	ipv4: Pass struct net into ip_defrag and ip_check_defrag	2015-10-12 19:44:16 -07:00
ipcomp.h
ipconfig.h
ipv6.h	ipv6: add complete rcu protection around np->opt	2015-12-02 23:37:16 -05:00
ipx.h
iw_handler.h
l3mdev.h	net: Add IPv6 support to l3mdev	2015-10-13 04:55:04 -07:00
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h	dst: Pass net into dst->output	2015-10-08 04:27:03 -07:00
mac80211.h	mac80211: always set the buf_size in AddBA req to 64	2015-11-20 11:39:40 +01:00
mac802154.h	6lowpan: cleanup lowpan_header_decompress	2015-10-21 00:49:24 +02:00
mip6.h
mld.h
mpls_iptunnel.h	mpls: multipath route support	2015-10-23 06:26:42 -07:00
mpls.h
mrp.h
ndisc.h	Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests"	2015-12-01 15:07:59 -05:00
neighbour.h	net: add explicit logging and stat for neighbour table overflow	2015-08-10 13:46:21 -07:00
net_namespace.h	netfilter: nfacct: per network namespace support	2015-08-07 11:50:56 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	netlink: add nla_get for le32 and le64	2015-09-30 13:16:44 +02:00
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h	nl802154: add support for security layer	2015-09-30 13:16:44 +02:00
p8022.h
ping.h
pkt_cls.h
pkt_sched.h	net: sched: consolidate tc_classify{,_compat}	2015-08-27 14:18:48 -07:00
protocol.h
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	tcp/dccp: fix race at listener dismantle phase	2015-10-16 00:52:19 -07:00
rose.h
route.h	net: Add source address lookup op for VRF	2015-10-07 04:27:44 -07:00
rtnetlink.h	netlink: Rightsize IFLA_AF_SPEC size calculation	2015-10-21 19:15:20 -07:00
sch_generic.h	net_sched: fix qdisc_tree_decrease_qlen() races	2015-12-03 14:59:05 -05:00
scm.h
secure_seq.h
slhc_vj.h
snmp.h
sock.h	net: fix IP early demux races	2015-12-14 23:52:00 -05:00
Space.h
stp.h
switchdev.h	net: switchdev: fix return code of fdb_dump stub	2015-11-16 15:24:37 -05:00
tcp_memcontrol.h
tcp_states.h
tcp.h	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
timewait_sock.h	inet: remove BUG_ON() in twsk_destructor()	2015-07-09 15:12:20 -07:00
transp_v6.h
tso.h	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
udp_tunnel.h	vxlan: do not receive IPv4 packets on IPv6 socket	2015-08-29 13:07:54 -07:00
udp.h
udplite.h
vsock_addr.h
vxlan.h	vxlan: fix incorrect RCO bit in VXLAN header	2015-12-05 18:15:29 -05:00
wext.h
wimax.h
x25.h
x25device.h
xfrm.h	xfrm: add rcu protection to sk->sk_policy[]	2015-12-11 19:22:06 -05:00