On 04/23/2018 11:32 AM, David Ahern wrote:
> kbuild test robot reported 2 uses of rt->from not properly accessed
> using rcu_dereference:
> 1. add rcu_dereference_protected to rt6_remove_exception_rt and make
> sure it is always called with rcu lock held.
>
> 2. change rt6_do_redirect to take a reference on 'from' when accessed
> the first time so it can be used the sceond time outside of the lock
>
> Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
> Reported-by: kbuild test robot <l...@intel.com>
> Signed-off-by: David Ahern <dsah...@gmail.com>
> ---
> net/ipv6/route.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 354a5b8d016f..ac3e51631c65 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1541,11 +1541,13 @@ static struct rt6_info *rt6_find_cached_rt(struct
> fib6_info *rt,
> static int rt6_remove_exception_rt(struct rt6_info *rt)
> {
> struct rt6_exception_bucket *bucket;
> - struct fib6_info *from = rt->from;
> struct in6_addr *src_key = NULL;
> struct rt6_exception *rt6_ex;
> + struct fib6_info *from;
> int err;
>
> + from = rcu_dereference_protected(rt->from,
> + lockdep_is_held(&rt6_exception_lock));
This does not make any sense.
We lock rt6_exception_lock a bit later in this function (line 1558)
If we really were holding rt6_exception_lock here we would dead lock.
> if (!from ||
> !(rt->rt6i_flags & RTF_CACHE))
> return -EINVAL;
> @@ -2223,6 +2225,7 @@ static void ip6_link_failure(struct sk_buff *skb)
