FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2025-01-12 04:19:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Revert "net/ipv6: fix metrics leak"

Browse Source 
This reverts commit df18b50448fab1dff093731dfd0e25e77e1afcd1.

This change causes other problems and use-after-free situations as
found by syzbot.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2018-08-01 21:32:30 -07:00
parent c01f6c9b32
commit e6aed040ea
1 changed files with 4 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/ipv6/ip6_fib.c
View File

@ -167,22 +167,11 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
return f6i; return f6i;
} }
static void fib6_metrics_release(struct fib6_info *f6i)
{
struct dst_metrics *m;
if (!f6i)
return;
m = f6i->fib6_metrics;
if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
kfree(m);
}
void fib6_info_destroy_rcu(struct rcu_head *head) void fib6_info_destroy_rcu(struct rcu_head *head)
{ {
struct fib6_info *f6i = container_of(head, struct fib6_info, rcu); struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
struct rt6_exception_bucket *bucket; struct rt6_exception_bucket *bucket;
struct dst_metrics *m;
WARN_ON(f6i->fib6_node); WARN_ON(f6i->fib6_node);
@ -212,7 +201,9 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
if (f6i->fib6_nh.nh_dev) if (f6i->fib6_nh.nh_dev)
dev_put(f6i->fib6_nh.nh_dev); dev_put(f6i->fib6_nh.nh_dev);
fib6_metrics_release(f6i); m = f6i->fib6_metrics;
if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
kfree(m);
kfree(f6i); kfree(f6i);
} }
@ -896,7 +887,6 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
from = rcu_dereference_protected(pcpu_rt->from, from = rcu_dereference_protected(pcpu_rt->from,
lockdep_is_held(&table->tb6_lock)); lockdep_is_held(&table->tb6_lock));
fib6_metrics_release(from);
rcu_assign_pointer(pcpu_rt->from, NULL); rcu_assign_pointer(pcpu_rt->from, NULL);
fib6_info_release(from); fib6_info_release(from);
} }