iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/core
History
WANG Cong e252b3d1a1 route: fix a use-after-free 
This patch fixes the following crash:

 general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000
 RIP: 0010:[<ffffffff8182f91b>]  [<ffffffff8182f91b>] dst_destroy+0xa6/0xef
 RSP: 0018:ffff880107603e38  EFLAGS: 00010202
 RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0
 RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b
 RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001
 R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000
 R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f
 FS:  0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0
 Stack:
  ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000
  ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e
  ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280
 Call Trace:
  <IRQ>
  [<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d
  [<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb
  [<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb
  [<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb
  [<ffffffff8107e11b>] __do_softirq+0x178/0x39f
  [<ffffffff8107e52e>] irq_exit+0x41/0x95
  [<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40
  [<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80
  <EOI>
  [<ffffffff8100b968>] ? default_idle+0x21/0x32
  [<ffffffff8100b966>] ? default_idle+0x1f/0x32
  [<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11
  [<ffffffff810b0bc7>] default_idle_call+0x1f/0x21
  [<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273
  [<ffffffff8102fe67>] start_secondary+0x135/0x156

dst is freed right before lwtstate_put(), this is not correct...

Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry")
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-25 14:29:19 -07:00
..
datagram.c
net: Fix skb_set_peeked use-after-free bug
2015-08-06 21:55:47 -07:00
dev_addr_lists.c
net: fix spelling for synchronized
2014-11-18 15:26:32 -05:00
dev_ioctl.c
dev_ioctl: use sizeof(x) instead of sizeof x
2014-11-18 15:27:32 -05:00
dev.c
net: warn if drivers set tx_queue_len = 0
2015-08-18 11:55:08 -07:00
drop_monitor.c
net: Replace get_cpu_var through this_cpu_ptr
2014-08-26 13:45:47 -04:00
dst.c
route: fix a use-after-free
2015-08-25 14:29:19 -07:00
ethtool.c
net/ethtool: Add current supported tunable options
2015-06-11 00:36:37 -07:00
fib_rules.c
fib: Add fib rule match on tunnel id
2015-07-21 10:39:06 -07:00
filter.c
route: move lwtunnel state to dst_entry
2015-08-20 15:42:36 -07:00
flow_dissector.c
net: Add functions to get skb->hash based on flow structures
2015-07-31 17:07:11 -07:00
flow.c
flowcache: Fix kernel panic in flow_cache_flush_task
2015-02-05 14:38:53 -08:00
gen_estimator.c
net_sched: gen_estimator: extend pps limit
2015-07-08 13:59:20 -07:00
gen_stats.c
gen_stats.c: Duplicate xstats buffer for later use
2015-02-19 15:45:53 -05:00
link_watch.c
dev: introduce dev_get_iflink()
2015-04-02 14:04:59 -04:00
lwtunnel.c
lwt: Add cfg argument to build_state
2015-08-24 10:34:40 -07:00
Makefile
lwtunnel: infrastructure for handling light weight tunnels like mpls
2015-07-21 10:39:03 -07:00
neighbour.c
net: add explicit logging and stat for neighbour table overflow
2015-08-10 13:46:21 -07:00
net_namespace.c
netns: make nsid_lock per net
2015-05-17 23:41:11 -04:00
net-procfs.c
rps: selective flow shedding during softnet overflow
2013-05-20 13:48:04 -07:00
net-sysfs.c
net: allow sleeping when modifying store_rps_map
2015-08-13 21:40:57 -07:00
net-sysfs.h
net: netdev_kobject_init: annotate with __init
2014-01-05 20:27:54 -05:00
net-traces.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
netclassid_cgroup.c
cgroup: net_cls: fix false-positive "suspicious RCU usage"
2015-07-25 00:13:18 -07:00
netevent.c
netevent: remove automatic variable in register_netevent_notifier()
2015-05-31 00:03:21 -07:00
netpoll.c
net: rename vlan_tx_* helpers since "tx" is misleading there
2015-01-13 17:51:08 -05:00
netprio_cgroup.c
cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes
2014-07-15 11:05:09 -04:00
pktgen.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-08-13 16:23:11 -07:00
ptp_classifier.c
net: filter: split 'struct sk_filter' into socket and bpf parts
2014-08-02 15:03:58 -07:00
request_sock.c
inet: fix races with reqsk timers
2015-08-10 21:17:29 -07:00
rtnetlink.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-07-23 00:41:16 -07:00
scm.c
net: introduce helper macro for_each_cmsghdr
2014-12-10 22:41:55 -05:00
secure_seq.c
net: remove a sparse error in secure_dccpv6_sequence_number()
2015-05-25 22:55:37 -04:00
skbuff.c
net-next: Fix warning while make xmldocs caused by skbuff.c
2015-08-25 14:20:48 -07:00
sock_diag.c
sock_diag: define destruction multicast groups
2015-06-15 19:49:22 -07:00
sock.c
net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket
2015-07-30 15:59:12 -07:00
stream.c
tcp: set SOCK_NOSPACE under memory pressure
2015-05-09 17:38:36 -04:00
sysctl_net_core.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-03-20 18:51:09 -04:00
timestamping.c
net: skb_defer_rx_timestamp should check for phydev before setting up classify
2015-07-09 14:17:15 -07:00
tso.c
net: tso: fix unaligned access to crafted TCP header in helper API
2014-10-22 12:52:55 -04:00
utils.c
net: Add inet_proto_csum_replace_by_diff utility function
2015-08-17 21:33:06 -07:00