Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751537AbdCICgK (ORCPT ); Wed, 8 Mar 2017 21:36:10 -0500 Received: from mail-pg0-f68.google.com ([74.125.83.68]:33007 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750739AbdCICgI (ORCPT ); Wed, 8 Mar 2017 21:36:08 -0500 Message-ID: <1489025457.28631.19.camel@edumazet-glaptop3.roam.corp.google.com> Subject: Re: [PATCH net] dccp/tcp: fix routing redirect race From: Eric Dumazet To: Jon Maxwell Cc: gerrit@erg.abdn.ac.uk, davem@davemloft.net, edumazet@google.com, andreyknvl@google.com, kuznet@ms2.inr.ac.ru, jmorris@namei.org, yoshfuji@linux-ipv6.org, kaber@trash.net, ncardwell@google.com, dccp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, jmaxwell@redhat.com, Eric Garver , Hannes Sowa Date: Wed, 08 Mar 2017 18:10:57 -0800 In-Reply-To: <1489022121-20571-1-git-send-email-jmaxwell37@gmail.com> References: <1489022121-20571-1-git-send-email-jmaxwell37@gmail.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 414 Lines: 10 On Thu, 2017-03-09 at 12:15 +1100, Jon Maxwell wrote: > We have seen a few incidents lately where a dst_enty has been freed > with a dangling TCP socket reference (sk->sk_dst_cache) pointing to that > dst_entry. If the conditions/timings are right a crash then ensues when the > freed dst_entry is referenced later on. A Common crashing back trace is: Very nice catch ! Don't we have a similar issue for IPv6 ?