net: fix a race in dst_release()
authorEric Dumazet <edumazet@google.com>
Tue, 10 Nov 2015 01:51:23 +0000 (17:51 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Dec 2015 19:31:07 +0000 (14:31 -0500)
commitfa3ef2632e218ea0db67930a5302e17123d71d39
treedd0059574b64289cef3345be8b693db573bdc9cd
parentd780d212b55d09fbc354bc541ed9c48a5d5121cc
net: fix a race in dst_release()

[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ]

Only cpu seeing dst refcount going to 0 can safely
dereference dst->flags.

Otherwise an other cpu might already have freed the dst.

Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/dst.c