[PATCH] Fix dst_destroy() race

When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.

In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 4 insertions, 2 deletions

diff --git a/net/core/dst.c b/net/core/dst.c
index 3bf6cc434814..fc434ade5270 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -198,13 +198,15 @@ again:
 
         dst = child;
         if (dst) {
+                int nohash = dst->flags & DST_NOHASH;
+
                 if (atomic_dec_and_test(&dst->__refcnt)) {
                         /* We were real parent of this dst, so kill child. */
-                        if (dst->flags&DST_NOHASH)
+                        if (nohash)
                                 goto again;
                 } else {
                         /* Child is still referenced, return it for freeing. */
-                        if (dst->flags&DST_NOHASH)
+                        if (nohash)
                                 return dst;
                         /* Child is still in his hash table */
                 }