Commit 41bb78b4 authored by Xiaotian Feng's avatar Xiaotian Feng Committed by David S. Miller

net dst: fix percpu_counter list corruption and poison overwritten

There're some percpu_counter list corruption and poison overwritten warnings
in recent kernel, which is resulted by fc66f95c.

commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel
init the percpu_counter for dst entries, but, the percpu_counter is never destroyed
in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter
is still on the list, then if we insert/remove other percpu_counter, list corruption
resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of
the freed value, the poison overwritten is resulted then.

With the following patch, the percpu_counter list corruption and poison overwritten
warnings disappeared.
Signed-off-by: default avatarXiaotian Feng <dfeng@redhat.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: "Pekka Savola (ipv6)" <pekkas@netcore.fi>
Cc: James Morris <jmorris@namei.org>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Patrick McHardy <kaber@trash.net>
Acked-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8200a59f
...@@ -2741,6 +2741,7 @@ static void __net_exit ip6_route_net_exit(struct net *net) ...@@ -2741,6 +2741,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
kfree(net->ipv6.ip6_prohibit_entry); kfree(net->ipv6.ip6_prohibit_entry);
kfree(net->ipv6.ip6_blk_hole_entry); kfree(net->ipv6.ip6_blk_hole_entry);
#endif #endif
dst_entries_destroy(&net->ipv6.ip6_dst_ops);
} }
static struct pernet_operations ip6_route_net_ops = { static struct pernet_operations ip6_route_net_ops = {
...@@ -2832,5 +2833,6 @@ void ip6_route_cleanup(void) ...@@ -2832,5 +2833,6 @@ void ip6_route_cleanup(void)
xfrm6_fini(); xfrm6_fini();
fib6_gc_cleanup(); fib6_gc_cleanup();
unregister_pernet_subsys(&ip6_route_net_ops); unregister_pernet_subsys(&ip6_route_net_ops);
dst_entries_destroy(&ip6_dst_blackhole_ops);
kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep); kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment