On 03/26/2018 07:48 AM, Alexey Kodanev wrote:
> After commit 33c162a980fe ("ipv6: datagram: Update dst cache of a
> connected datagram sk during pmtu update"), when the error occurs on
> sending datagram in udpv6_sendmsg() due to ICMPV6_PKT_TOOBIG type,
> error handler can trigger the following path and call ip6_dst_store():
>
> udpv6_err()
> ip6_sk_update_pmtu()
> ip6_datagram_dst_update()
> ip6_dst_lookup_flow(), can create a RTF_CACHE clone
> ...
> ip6_dst_store()
>
> It can happen before a connected UDP socket invokes ip6_dst_store()
> in the end of udpv6_sendmsg(), on destination release, as a result,
> the last one changes dst to the old one, preventing getting updated
> dst cache on the next udpv6_sendmsg() call.
>
> This patch moves ip6_dst_store() in udpv6_sendmsg(), so that it is
> invoked after ip6_sk_dst_lookup_flow() and before udp_v6_send_skb().
>
> Also, increase refcnt for dst, when passing it to ip6_dst_store()
> because after that the dst cache can be released by other calls
> to ip6_dst_store() with the same socket.
>
> Fixes: 33c162a980fe ("ipv6: datagram: Update dst cache of a connected
> datagram sk during pmtu update")
> Signed-off-by: Alexey Kodanev <alexey.koda...@oracle.com>
> ---
>
Reviewed-by: Eric Dumazet <eduma...@google.com>
Thanks Alexey.
