From: Taehee Yoo <ap420...@gmail.com> Date: Mon, 15 Jun 2020 15:07:51 +0000
> In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses > fallback tunnel device pointer, which is fb_tunnel_dev. > This pointer is protected by RTNL. It's not enough to be used > in the datapath. > So, this pointer would be used after an interface is deleted. > It eventually results in the use-after-free problem. > > In order to avoid the problem, the new tunnel pointer variable is added, > which indicates a fallback tunnel device's tunnel pointer. > This is protected by both RTNL and RCU. > So, it's safe to be used in the datapath. ... I'm marking this changes requested because it seems like the feedback Eric Dumazet provided for the ip_tunnel version of this fix applies here too. Thank you.
