Re: [PATCH net 3/3] ipv6: Fix dst_entry refcnt bugs in ip6_tunnel

On Tue, Sep 01, 2015 at 02:26:58PM -0700, Eric Dumazet wrote:

On Tue, 2015-09-01 at 13:55 -0700, Martin KaFai Lau wrote:

quoted

On Tue, Sep 01, 2015 at 01:14:20PM -0700, Eric Dumazet wrote:

quoted

It should not be a problem. refcnt is taken when/if necessary (skb
queued on a qdisc for example)

We have other uses of skb_dst_set_noref()

Please describe the problem ?

The current ip6_tnl_dst_get() does not take the dst refcnt.

If the dst is released after ip6_tnl_dst_get() and before
skb_dst_set_noref(), would it cause an issue?

We are under rcu here, and a dst in a cache is protected by RCU by
definition.

skb_dst_set_noref() has following debugging clause, does it trigger for
you ?

WARN_ON(!rcu_read_lock_held() && !rcu_read_lock_bh_held());

No. I did not see this.

I am probably missing something.  Do you mean the rcu can
protect the followings:


ip6_tnl_dst_get()
			dst_release()
						dst_free() /* refcnt is 0 */
skb_dst_set_noref()

--------

or for DST_NOCACHE

ip6_tnl_dst_get()
			dst_release() /* refcnt is 0 */
skb_dst_set_noref()
/* ip6tunnel_xmit()
 * or its callees
 * take a dst refcnt
 */

--------

or the above situation does not matter/will not happen?