Merge branch 'ipv6-fix-issues-on-accessing-fib6_metrics' (69ba423d) · Commits · 戴 / test

Wei Wang says: ==================== ipv6: fix issues on accessing fib6_metrics The latest fix on the memory leak of fib6_metrics still causes use-after-free. This patch series first revert the previous fix and propose a new fix that is more inline with ipv4 logic and is tested to fix the use-after-free issue reported. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/route.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -364,11 +364,14 @@ EXPORT_SYMBOL(ip6_dst_alloc);

		static void ip6_dst_destroy(struct dst_entry *dst)
		{
		struct dst_metrics p = (struct dst_metrics )DST_METRICS_PTR(dst);
		struct rt6_info rt = (struct rt6_info )dst;
		struct fib6_info *from;
		struct inet6_dev *idev;

		dst_destroy_metrics_generic(dst);
		if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
		kfree(p);

		rt6_uncached_list_del(rt);

		idev = rt->rt6i_idev;
		@@ -976,6 +979,10 @@ static void rt6_set_from(struct rt6_info rt, struct fib6_info from)
		rt->rt6i_flags &= ~RTF_EXPIRES;
		rcu_assign_pointer(rt->from, from);
		dst_init_metrics(&rt->dst, from->fib6_metrics->metrics, true);
		if (from->fib6_metrics != &dst_default_metrics) {
		rt->dst._metrics \|= DST_METRICS_REFCOUNTED;
		refcount_inc(&from->fib6_metrics->refcnt);
		}
		}

		/* Caller must already hold reference to @ort */

Admin message