Commit ad65a2f0 authored by Wei Wang's avatar Wei Wang Committed by David S. Miller

ipv6: call dst_hold_safe() properly

Similar as ipv4, ipv6 path also needs to call dst_hold_safe() when
necessary to avoid double free issue on the dst.
Signed-off-by: default avatarWei Wang <weiwan@google.com>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9514528d
...@@ -5576,7 +5576,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) ...@@ -5576,7 +5576,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
ip6_del_rt(rt); ip6_del_rt(rt);
} }
if (ifp->rt) { if (ifp->rt) {
dst_hold(&ifp->rt->dst); if (dst_hold_safe(&ifp->rt->dst))
ip6_del_rt(ifp->rt); ip6_del_rt(ifp->rt);
} }
rt_genid_bump_ipv6(net); rt_genid_bump_ipv6(net);
......
...@@ -1366,7 +1366,7 @@ static void ip6_link_failure(struct sk_buff *skb) ...@@ -1366,7 +1366,7 @@ static void ip6_link_failure(struct sk_buff *skb)
rt = (struct rt6_info *) skb_dst(skb); rt = (struct rt6_info *) skb_dst(skb);
if (rt) { if (rt) {
if (rt->rt6i_flags & RTF_CACHE) { if (rt->rt6i_flags & RTF_CACHE) {
dst_hold(&rt->dst); if (dst_hold_safe(&rt->dst))
ip6_del_rt(rt); ip6_del_rt(rt);
} else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) { } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
rt->rt6i_node->fn_sernum = -1; rt->rt6i_node->fn_sernum = -1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment