Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 981dc8a4 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "dst: Use after free in __dst_destroy_metrics_generic"

parents e8c25839 6709ad14

net/core/dst.c

+9 −2
Original line number Original line Diff line number Diff line
@@ -349,8 +349,15 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) 




	new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;

	new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;

	prev = cmpxchg(&dst->_metrics, old, new);

	prev = cmpxchg(&dst->_metrics, old, new);

	if (prev == old)

	if (prev == old) {

		kfree(__DST_METRICS_PTR(old));

		struct dst_metrics *old_p = (struct dst_metrics *)

					    __DST_METRICS_PTR(old);



		if (prev & DST_METRICS_REFCOUNTED) {

			if (atomic_dec_and_test(&old_p->refcnt))

				kfree(old_p);

		}

	}

}

}

EXPORT_SYMBOL(__dst_destroy_metrics_generic);

EXPORT_SYMBOL(__dst_destroy_metrics_generic);