Re: [RFC] ipv6: rt6_update_expires() seems racy

Thank you Eric!  I'll look at this in detail today

Neil

Eric Dumazet [off-list ref] wrote:

Some strange crashes happen in rt6_check_expired(), with access
to random addresses.

At first glance, it looks like the RTF_EXPIRES and
stuff added in commit 1716a96101c49186b
(ipv6: fix problem with expired dst cache)
are racy : same dst could be manipulated at the same time
on different cpus.

At some point, our stack believes rt->dst.from contains a dst pointer,
while its really a jiffie value (as rt->dst.expires shares the same area
of memory)

rt6_update_expires() should be fixed, or am I missing something ?

CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060