Commit 55432d2b authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

inetpeer: fix a race in inetpeer_gc_worker()

commit 5faa5df1 (inetpeer: Invalidate the inetpeer tree along with
the routing cache) added a race :

Before freeing an inetpeer, we must respect a RCU grace period, and make
sure no user will attempt to increase refcnt.

inetpeer_invalidate_tree() waits for a RCU grace period before inserting
inetpeer tree into gc_list and waking the worker. At that time, no
concurrent lookup can find a inetpeer in this tree.
Signed-off-by: default avatarEric Dumazet <>
Cc: Steffen Klassert <>
Acked-by: default avatarSteffen Klassert <>
Signed-off-by: default avatarDavid S. Miller <>
parent dd03cff2
......@@ -40,7 +40,10 @@ struct inet_peer {
u32 pmtu_orig;
u32 pmtu_learned;
struct inetpeer_addr_base redirect_learned;
struct list_head gc_list;
union {
struct list_head gc_list;
struct rcu_head gc_rcu;
* Once inet_peer is queued for deletion (refcnt == -1), following fields
* are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
......@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
static void inetpeer_inval_rcu(struct rcu_head *head)
struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
list_add_tail(&p->gc_list, &gc_list);
schedule_delayed_work(&gc_work, gc_delay);
void inetpeer_invalidate_tree(int family)
struct inet_peer *old, *new, *prev;
......@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family)
prev = cmpxchg(&base->root, old, new);
if (prev == old) {
base->total = 0;
list_add_tail(&prev->gc_list, &gc_list);
schedule_delayed_work(&gc_work, gc_delay);
call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment