• Eric Dumazet's avatar
    net: drop dst before queueing fragments · 97599dc7
    Eric Dumazet authored
    Commit 4a94445c (net: Use ip_route_input_noref() in input path)
    added a bug in IP defragmentation handling, as non refcounted
    dst could escape an RCU protected section.
    
    Commit 64f3b9e2 (net: ip_expire() must revalidate route) fixed
    the case of timeouts, but not the general problem.
    
    Tom Parkin noticed crashes in UDP stack and provided a patch,
    but further analysis permitted us to pinpoint the root cause.
    
    Before queueing a packet into a frag list, we must drop its dst,
    as this dst has limited lifetime (RCU protected)
    
    When/if a packet is finally reassembled, we use the dst of the very
    last skb, still protected by RCU and valid, as the dst of the
    reassembled packet.
    
    Use same logic in IPv6, as there is no need to hold dst references.
    Reported-by: default avatarTom Parkin <tparkin@katalix.com>
    Tested-by: default avatarTom Parkin <tparkin@katalix.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    97599dc7
ip_fragment.c 21.5 KB