net: fix a race in dst_release()
authorEric Dumazet <edumazet@google.com>
Tue, 10 Nov 2015 01:51:23 +0000 (17:51 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Dec 2015 18:40:07 +0000 (13:40 -0500)
commit0be0e5758dbdf3f61378b5d17d00363f92e93bae
tree3c199964648d3d26b653a05f410082d9d2723a2d
parent0861d012ecff07b74a8c6ecfda04bb1737831e09
net: fix a race in dst_release()

[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ]

Only cpu seeing dst refcount going to 0 can safely
dereference dst->flags.

Otherwise an other cpu might already have freed the dst.

Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/dst.c