ipv6: A few fixes on dereferencing rt->from
authorMartin KaFai Lau <kafai@fb.com>
Tue, 30 Apr 2019 17:45:12 +0000 (10:45 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 1 May 2019 21:17:54 +0000 (17:17 -0400)
commit886b7a50100a50f1cbd08a6f8ec5884dfbe082dc
treef18e97f6f5ac9054af65539f00e52c6160470a20
parentf3505745c07ff50c22aeca9dde98762d1c8b5898
ipv6: A few fixes on dereferencing rt->from

It is a followup after the fix in
commit 9c69a1320515 ("route: Avoid crash from dereferencing NULL rt->from")

rt6_do_redirect():
1. NULL checking is needed on rt->from because a parallel
   fib6_info delete could happen that sets rt->from to NULL.
   (e.g. rt6_remove_exception() and fib6_drop_pcpu_from()).

2. fib6_info_hold() is not enough.  Same reason as (1).
   Meaning, holding dst->__refcnt cannot ensure
   rt->from is not NULL or rt->from->fib6_ref is not 0.

   Instead of using fib6_info_hold_safe() which ip6_rt_cache_alloc()
   is already doing, this patch chooses to extend the rcu section
   to keep "from" dereference-able after checking for NULL.

inet6_rtm_getroute():
1. NULL checking is also needed on rt->from for a similar reason.
   Note that inet6_rtm_getroute() is using RTNL_FLAG_DOIT_UNLOCKED.

Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Wei Wang <weiwan@google.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/route.c