ipv4: Restore old dst_free() behavior.

commit 404e0a8b6a55 (net: ipv4: fix RCU races on dst refcounts) tried
to solve a race but added a problem at device/fib dismantle time :

We really want to call dst_free() as soon as possible, even if sockets
still have dst in their cache.
dst_release() calls in free_fib_info_rcu() are not welcomed.

Root of the problem was that now we also cache output routes (in
nh_rth_output), we must use call_rcu() instead of call_rcu_bh() in
rt_free(), because output route lookups are done in process context.

Based on feedback and initial patch from David Miller (adding another
call_rcu_bh() call in fib, but it appears it was not the right fix)

I left the inet_sk_rx_dst_set() helper and added __rcu attributes
to nh_rth_output and nh_rth_input to better document what is going on in
this code.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 11 insertions, 10 deletions

diff --git a/include/net/dst.h b/include/net/dst.h
index 31a9fd39edb6..baf597890064 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -61,7 +61,6 @@ struct dst_entry {
 #define DST_NOPEER              0x0040
 #define DST_FAKE_RTABLE         0x0080
 #define DST_XFRM_TUNNEL         0x0100
-#define DST_RCU_FREE            0x0200
 
         unsigned short          pending_confirm;
 
@@ -383,6 +382,12 @@ static inline void dst_free(struct dst_entry *dst)
         __dst_free(dst);
 }
 
+static inline void dst_rcu_free(struct rcu_head *head)
+{
+        struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
+        dst_free(dst);
+}
+
 static inline void dst_confirm(struct dst_entry *dst)
 {
         dst->pending_confirm = 1;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index e3fd34c83ac9..83b567fe1941 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -253,13 +253,9 @@ static inline void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        if (atomic_inc_not_zero(&dst->__refcnt)) {
-                if (!(dst->flags & DST_RCU_FREE))
-                        dst->flags |= DST_RCU_FREE;
-
-                sk->sk_rx_dst = dst;
-                inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
-        }
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 }
 
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index e69c3a47153d..e521a03515b1 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -81,8 +81,8 @@ struct fib_nh {
         __be32                  nh_gw;
         __be32                  nh_saddr;
         int                     nh_saddr_genid;
-        struct rtable           *nh_rth_output;
-        struct rtable           *nh_rth_input;
+        struct rtable __rcu     *nh_rth_output;
+        struct rtable __rcu     *nh_rth_input;
         struct fnhe_hash_bucket *nh_exceptions;
 };