ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero (65a3c497) · Commits · 戴 / test

Before taking a refcount, make sure the object is not already scheduled for deletion. Same fix is needed in ipv6_flowlabel_opt() Fixes: ("ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.") Signed-off-by:

Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/ip6_flowlabel.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -250,9 +250,9 @@ struct ip6_flowlabel fl6_sock_lookup(struct sock sk, __be32 label)
		rcu_read_lock_bh();
		for_each_sk_fl_rcu(np, sfl) {
		struct ip6_flowlabel *fl = sfl->fl;
		if (fl->label == label) {

		if (fl->label == label && atomic_inc_not_zero(&fl->users)) {
		fl->lastuse = jiffies;
		atomic_inc(&fl->users);
		rcu_read_unlock_bh();
		return fl;
		}
		@@ -618,7 +618,8 @@ int ipv6_flowlabel_opt(struct sock sk, char __user optval, int optlen)
		goto done;
		}
		fl1 = sfl->fl;
		atomic_inc(&fl1->users);
		if (!atomic_inc_not_zero(&fl1->users))
		fl1 = NULL;
		break;
		}
		}

Admin message