From e74408dedab0783d1cb6242cdcfa5823e641ca89 Mon Sep 17 00:00:00 2001 From: Xin Long Date: Thu, 16 May 2019 18:15:11 +0000 Subject: [PATCH] net: use rcu_dereference_protected to fetch sk_dst_cache in sk_destruct mainline inclusion from mainline-5.1 commit 5869b8fadad0 category: bugfix bugzilla: 14979 CVE: NA ------------------------------------------------- As Eric noticed, in .sk_destruct, sk->sk_dst_cache update is prevented, and no barrier is needed for this. So change to use rcu_dereference_protected() instead of rcu_dereference_check() to fetch sk_dst_cache in there. v1->v2: - no change, repost after net-next is open. Reported-by: Eric Dumazet Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Zhiqiang Liu Reviewed-by: Wenan Mao Signed-off-by: Yang Yingliang --- net/decnet/af_decnet.c | 2 +- net/ipv4/af_inet.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c index 7d6ff983ba2c..d2ae2b0ccb97 100644 --- a/net/decnet/af_decnet.c +++ b/net/decnet/af_decnet.c @@ -444,7 +444,7 @@ static void dn_destruct(struct sock *sk) skb_queue_purge(&scp->other_xmit_queue); skb_queue_purge(&scp->other_receive_queue); - dst_release(rcu_dereference_check(sk->sk_dst_cache, 1)); + dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); } static unsigned long dn_memory_pressure; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 07749c5b0a50..0aef0e3ef260 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -156,7 +156,7 @@ void inet_sock_destruct(struct sock *sk) WARN_ON(sk->sk_forward_alloc); kfree(rcu_dereference_protected(inet->inet_opt, 1)); - dst_release(rcu_dereference_check(sk->sk_dst_cache, 1)); + dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); dst_release(sk->sk_rx_dst); sk_refcnt_debug_dec(sk); } -- GitLab