On Tue, 16 Jun 2020 at 10:17, David Miller <da...@davemloft.net> wrote: >
Hi David, Thank you for the review :) > From: Taehee Yoo <ap420...@gmail.com> > Date: Mon, 15 Jun 2020 15:07:51 +0000 > > > In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses > > fallback tunnel device pointer, which is fb_tunnel_dev. > > This pointer is protected by RTNL. It's not enough to be used > > in the datapath. > > So, this pointer would be used after an interface is deleted. > > It eventually results in the use-after-free problem. > > > > In order to avoid the problem, the new tunnel pointer variable is added, > > which indicates a fallback tunnel device's tunnel pointer. > > This is protected by both RTNL and RCU. > > So, it's safe to be used in the datapath. > ... > > I'm marking this changes requested because it seems like the feedback Eric > Dumazet provided for the ip_tunnel version of this fix applies here too. > > Thank you. I will send a v2 patch soon. Thanks a lot! Taehee Yoo
