net: fix a race in dst_release()
authorEric Dumazet <edumazet@google.com>
Tue, 10 Nov 2015 01:51:23 +0000 (17:51 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Dec 2015 19:03:13 +0000 (14:03 -0500)
commite6fac8c7fff3d816729ad16327837ba3216d48c9
treeae47301b16d7e74b7983d24cb27745bc67c4c132
parent97c28b72a5ceb80e193910cbed068b44c951bd94
net: fix a race in dst_release()

[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ]

Only cpu seeing dst refcount going to 0 can safely
dereference dst->flags.

Otherwise an other cpu might already have freed the dst.

Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/dst.c