diff options
| author |   David S. Miller <davem@davemloft.net> | 2019-05-28 17:22:15 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-05-28 17:22:15 -0700 |
| commit | 2e56571d820d46d9d54c1ae0e113a91d1c07814f (patch) | |
| tree | 3a2cd75dc3f1b69cae61b597b8f1f42c006757a1 /include | |
| parent | selftests/net: ipv6 flowlabel (diff) | |
| parent | inet: frags: fix use-after-free read in inet_frag_destroy_rcu (diff) | |
Merge branch 'inet-frags-followup'
Eric Dumazet says:
====================
inet: frags: followup to 'inet-frags-avoid-possible-races-at-netns-dismantle'
Latest patch series ('inet-frags-avoid-possible-races-at-netns-dismantle')
brought another syzbot report shown in the third patch changelog.
While fixing the issue, I had to call inet_frags_fini() later
in IPv6 and ilowpan.
Also I believe a completion is needed to ensure proper dismantle
at module removal.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/inet_frag.h | 23 |
1 files changed, 4 insertions, 19 deletions
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 002f23c1a1a7..e91b79ad4e4a 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -3,6 +3,7 @@ #define __NET_FRAG_H__ #include <linux/rhashtable-types.h> +#include <linux/completion.h> /* Per netns frag queues directory */ struct fqdir { @@ -104,30 +105,14 @@ struct inet_frags { struct kmem_cache *frags_cachep; const char *frags_cache_name; struct rhashtable_params rhash_params; + refcount_t refcnt; + struct completion completion; }; int inet_frags_init(struct inet_frags *); void inet_frags_fini(struct inet_frags *); -static inline int fqdir_init(struct fqdir **fqdirp, struct inet_frags *f, - struct net *net) -{ - struct fqdir *fqdir = kzalloc(sizeof(*fqdir), GFP_KERNEL); - int res; - - if (!fqdir) - return -ENOMEM; - fqdir->f = f; - fqdir->net = net; - res = rhashtable_init(&fqdir->rhashtable, &fqdir->f->rhash_params); - if (res < 0) { - kfree(fqdir); - return res; - } - *fqdirp = fqdir; - return 0; -} - +int fqdir_init(struct fqdir **fqdirp, struct inet_frags *f, struct net *net); void fqdir_exit(struct fqdir *fqdir); void inet_frag_kill(struct inet_frag_queue *q); |