Re: [PATCH] ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

On Wed, 2012-05-23 at 09:13 +0200, Eric Dumazet wrote:

On Wed, 2012-05-23 at 08:55 +0200, Eric Dumazet wrote:

quoted

Please hold on, I'll send a v2

I believe your patch should be fine, if you move back the
fib_info_cnt--;

So only do the dev_put() in free_fib_info_rcu().

We would do so in a new patch.

No need to clear nh_dev to NULL since we are freeing fi at the end of
function.

David suggests to reset it to NULL to detect other potential
race conditions.

Besides above suggestions, how do you think about:

fib_create_info=>fib_find_info, but fib_find_info is not protected by
fib_info_lock. See the codes:

fib_create_info()
{
	...
link_it:
        ofi = fib_find_info(fi);
        if (ofi) {
                fi->fib_dead = 1;
                free_fib_info(fi);
                ofi->fib_treeref++;
                return ofi;
        }
        fi->fib_treeref++;
        atomic_inc(&fi->fib_clntref);
        spin_lock_bh(&fib_info_lock);

	...
}

I plan to change it to hold fib_info_lock before calling fib_find_info. Is
it ok for you?

Thanks for the direct speaking.

Yanmin