Re: [IPSEC] Store idev entries (was: [PATCH][IPv6][IPsec] stop infinite loop)

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Tue, May 03, 2005 at 04:26:28PM -0700, David S. Miller wrote:
> 
> Applied, thanks Herbert.

Thanks Dave.

BTW, I was reviewing the rt6i_idev usage in IPv6 and it seems to me
that they need some protection with locking or RCU.  As it is they
are simply dereferenced in user/softirq context with no locking.

For example, the call chain udpv6_sendmsg -> ip6_dst_lookup ->
ipv6_get_saddr occurs in user context and simply dereferences
rt6i_idev.  The race condition is that another CPU could come
in and free rt6i_idev.  The reference count held by the dst
entry doesn't help since the other CPU will drop the reference
count for us through dst_ifdown.

Yoshifuji-san, does this look like a real problem to you?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt