tcp_metrics: add missing barriers on delete

[ Upstream commit cbc3a153222805d65f821e10f4f78b6afce06f86 ]

When removing an item from RCU protected list, we must prevent
store-tearing, using rcu_assign_pointer() or WRITE_ONCE().

Fixes: 04f721c671656 ("tcp_metrics: Rewrite tcp_metrics_flush_all")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index c196759..4bfa2fb 100644 (file)
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -908,7 +908,7 @@ static void tcp_metrics_flush_all(struct net *net)
                        match = net ? net_eq(tm_net(tm), net) :
                                !refcount_read(&tm_net(tm)->ns.count);
                        if (match) {
-                               *pp = tm->tcpm_next;
+                               rcu_assign_pointer(*pp, tm->tcpm_next);
                                kfree_rcu(tm, rcu_head);
                        } else {
                                pp = &tm->tcpm_next;
@@ -949,7 +949,7 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
                if (addr_same(&tm->tcpm_daddr, &daddr) &&
                    (!src || addr_same(&tm->tcpm_saddr, &saddr)) &&
                    net_eq(tm_net(tm), net)) {
-                       *pp = tm->tcpm_next;
+                       rcu_assign_pointer(*pp, tm->tcpm_next);
                        kfree_rcu(tm, rcu_head);
                        found = true;
                } else {