Re: [PATCH] net: drop dst before queueing fragments

David Miller
2013-04-17T05:15:44Z

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 16 Apr 2013 15:55:41 -0700

> From: Eric Dumazet <edumazet@google.com>
>
> Commit 4a94445c9a5c (net: Use ip_route_input_noref() in input path)
> added a bug in IP defragmentation handling, as non refcounted
> dst could escape an RCU protected section.
>
> Commit 64f3b9e203bd068 (net: ip_expire() must revalidate route) fixed
> the case of timeouts, but not the general problem.
>
> Tom Parkin noticed crashes in UDP stack and provided a patch,
> but further analysis permitted us to pinpoint the root cause.
>
> Before queueing a packet into a frag list, we must drop its dst,
> as this dst has limited lifetime (RCU protected)
>
> When/if a packet is finally reassembled, we use the dst of the very
> last skb, still protected by RCU and valid, as the dst of the
> reassembled packet.
>
> Use same logic in IPv6, as there is no need to hold dst references.
>
> Reported-by: Tom Parkin <tparkin@katalix.com>
> Tested-by: Tom Parkin <tparkin@katalix.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied.