Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69ba423d authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'ipv6-fix-issues-on-accessing-fib6_metrics' 



Wei Wang says:

====================
ipv6: fix issues on accessing fib6_metrics

The latest fix on the memory leak of fib6_metrics still causes
use-after-free.
This patch series first revert the previous fix and propose a new fix
that is more inline with ipv4 logic and is tested to fix the
use-after-free issue reported.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 126d6848 ce7ea4af

net/ipv6/route.c

+8 −1
Original line number Diff line number Diff line
@@ -364,11 +364,14 @@ EXPORT_SYMBOL(ip6_dst_alloc); 


static void ip6_dst_destroy(struct dst_entry *dst)

{

	struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);

	struct rt6_info *rt = (struct rt6_info *)dst;

	struct fib6_info *from;

	struct inet6_dev *idev;



	dst_destroy_metrics_generic(dst);

	if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))

		kfree(p);



	rt6_uncached_list_del(rt);



	idev = rt->rt6i_idev;
@@ -976,6 +979,10 @@ static void rt6_set_from(struct rt6_info *rt, struct fib6_info *from) 
	rt->rt6i_flags &= ~RTF_EXPIRES;

	rcu_assign_pointer(rt->from, from);

	dst_init_metrics(&rt->dst, from->fib6_metrics->metrics, true);

	if (from->fib6_metrics != &dst_default_metrics) {

		rt->dst._metrics |= DST_METRICS_REFCOUNTED;

		refcount_inc(&from->fib6_metrics->refcnt);

	}

}



/* Caller must already hold reference to @ort */