Commit 25563b58 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: fix possible store tearing in neigh_periodic_work() 



While looking at a related syzbot report involving neigh_periodic_work(),
I found that I forgot to add an annotation when deleting an
RCU protected item from a list.

Readers use rcu_deference(*np), we need to use either
rcu_assign_pointer() or WRITE_ONCE() on writer side
to prevent store tearing.

I use rcu_assign_pointer() to have lockdep support,
this was the choice made in neigh_flush_dev().

Fixes: 767e97e1 ("neigh: RCU conversion of struct neighbour")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c15cd642

net/core/neighbour.c

+3 −1
Original line number Diff line number Diff line
@@ -988,7 +988,9 @@ static void neigh_periodic_work(struct work_struct *work) 
			    (state == NUD_FAILED ||

			     !time_in_range_open(jiffies, n->used,

						 n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {

				*np = n->next;

				rcu_assign_pointer(*np,

					rcu_dereference_protected(n->next,

						lockdep_is_held(&tbl->lock)));

				neigh_mark_dead(n);

				write_unlock(&n->lock);

				neigh_cleanup_and_release(n);