diff options
| author | WANG Cong | 2015-08-25 10:38:53 -0700 |
|---|---|---|
| committer | David S. Miller | 2015-08-25 14:29:19 -0700 |
| commit | e252b3d1a1744af1431aca30e091420734c2b012 (patch) | |
| tree | ad424a96934cb56d3b0363d77124a9b3697cf8c3 /net/core/dst.c | |
| parent | d7499160107dd1367cf34873564b522a5516430c (diff) | |
route: fix a use-after-free
This patch fixes the following crash:
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000
RIP: 0010:[<ffffffff8182f91b>] [<ffffffff8182f91b>] dst_destroy+0xa6/0xef
RSP: 0018:ffff880107603e38 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0
RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b
RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001
R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000
R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f
FS: 0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0
Stack:
ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000
ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e
ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280
Call Trace:
<IRQ>
[<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d
[<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb
[<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb
[<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb
[<ffffffff8107e11b>] __do_softirq+0x178/0x39f
[<ffffffff8107e52e>] irq_exit+0x41/0x95
[<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40
[<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80
<EOI>
[<ffffffff8100b968>] ? default_idle+0x21/0x32
[<ffffffff8100b966>] ? default_idle+0x1f/0x32
[<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11
[<ffffffff810b0bc7>] default_idle_call+0x1f/0x21
[<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273
[<ffffffff8102fe67>] start_secondary+0x135/0x156
dst is freed right before lwtstate_put(), this is not correct...
Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry")
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/dst.c')
| -rw-r--r-- | net/core/dst.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/core/dst.c b/net/core/dst.c index 50dcdbb0ee46..477035ed7903 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -262,11 +262,12 @@ again: if (dst->dev) dev_put(dst->dev); + lwtstate_put(dst->lwtstate); + if (dst->flags & DST_METADATA) kfree(dst); else kmem_cache_free(dst->ops->kmem_cachep, dst); - lwtstate_put(dst->lwtstate); dst = child; if (dst) { |