net: fix NULL dereferences in check_peer_redir()

BugLink: http://bugs.launchpad.net/bugs/931719

[ Upstream commit d3aaeb38c40e5a6c08dd31a1b64da65c4352be36, along
  with dependent backports of commits:
     69cce1d1404968f78b177a0314f5822d5afdbbfb
     9de79c127cccecb11ae6a21ab1499e87aa222880
     218fa90f072e4aeff9003d57e390857f4f35513e
     580da35a31f91a594f3090b7a2c39b85cb051a12
     f7e57044eeb1841847c24aa06766c8290c202583
     e049f28883126c689cf95859480d9ee4ab23b7fa ]

Gergely Kalman reported crashes in check_peer_redir().

It appears commit f39925dbde778 (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.

Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.

Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.

As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)

Many thanks to Gergely for providing a pretty report pointing to the
bug.

Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

1 files changed, 20 insertions, 11 deletions

diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 45cd30098e3..4f4c52c0eeb 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -225,11 +225,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
 
 static int
-__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+               struct net_device *dev, struct netdev_queue *txq,
+               struct neighbour *mn)
 {
-        struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-        struct teql_sched_data *q = qdisc_priv(dev_queue->qdisc);
-        struct neighbour *mn = skb_dst(skb)->neighbour;
+        struct teql_sched_data *q = qdisc_priv(txq->qdisc);
         struct neighbour *n = q->ncache;
 
         if (mn->tbl == NULL)
@@ -262,17 +262,26 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 }
 
 static inline int teql_resolve(struct sk_buff *skb,
-                               struct sk_buff *skb_res, struct net_device *dev)
+                               struct sk_buff *skb_res,
+                               struct net_device *dev,
+                               struct netdev_queue *txq)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        struct dst_entry *dst = skb_dst(skb);
+        struct neighbour *mn;
+        int res;
+
         if (txq->qdisc == &noop_qdisc)
                 return -ENODEV;
 
-        if (dev->header_ops == NULL ||
-            skb_dst(skb) == NULL ||
-            skb_dst(skb)->neighbour == NULL)
+        if (!dev->header_ops || !dst)
                 return 0;
-        return __teql_resolve(skb, skb_res, dev);
+
+        rcu_read_lock();
+        mn = dst_get_neighbour(dst);
+        res = mn ? __teql_resolve(skb, skb_res, dev, txq, mn) : 0;
+        rcu_read_unlock();
+
+        return res;
 }
 
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -307,7 +316,7 @@ restart:
                         continue;
                 }
 
-                switch (teql_resolve(skb, skb_res, slave)) {
+                switch (teql_resolve(skb, skb_res, slave, slave_txq)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);