This is a note to let you know that I've just added the patch titled net: fix a race in dst_release() to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-fix-a-race-in-dst_release.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Tue Nov 17 14:34:38 PST 2015 From: Eric Dumazet <edumazet@xxxxxxxxxx> Date: Mon, 9 Nov 2015 17:51:23 -0800 Subject: net: fix a race in dst_release() From: Eric Dumazet <edumazet@xxxxxxxxxx> [ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ] Only cpu seeing dst refcount going to 0 can safely dereference dst->flags. Otherwise an other cpu might already have freed the dst. Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") Reported-by: Greg Thelen <gthelen@xxxxxxxxxx> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/core/dst.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/core/dst.c +++ b/net/core/dst.c @@ -287,7 +287,7 @@ void dst_release(struct dst_entry *dst) if (unlikely(newrefcnt < 0)) net_warn_ratelimited("%s: dst:%p refcnt:%d\n", __func__, dst, newrefcnt); - if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) + if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) call_rcu(&dst->rcu_head, dst_destroy_rcu); } } Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-4.2/ipv6-gre-support-sit-encapsulation.patch queue-4.2/ipmr-fix-possible-race-resulting-from-improper-usage-of-ip_inc_stats_bh-in-preemptible-context.patch queue-4.2/net-avoid-null-deref-in-inet_ctl_sock_destroy.patch queue-4.2/net-fix-a-race-in-dst_release.patch queue-4.2/sit-fix-sit0-percpu-double-allocations.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html