From: Wei Wang <wei...@google.com> Date: Sat, 21 Jul 2018 20:56:32 -0700
> From: Wei Wang <wei...@google.com> > > In the code path where only rcu read lock is held, e.g. in the route > lookup code path, it is not safe to directly call fib6_info_hold() > because the fib6_info may already have been deleted but still exists > in the rcu grace period. Holding reference to it could cause double > free and crash the kernel. > > This patch adds a new function fib6_info_hold_safe() and replace > fib6_info_hold() in all necessary places. > > Syzbot reported 3 crash traces because of this. One of them is: ... > Fixes: 93531c674315 (net/ipv6: separate handling of FIB entries from dst > based routes) > Reported-by: syzbot+902e2a1bcd4f7808c...@syzkaller.appspotmail.com > Reported-by: syzbot+8ae62d67f647abeec...@syzkaller.appspotmail.com > Reported-by: syzbot+3f08feb1408693067...@syzkaller.appspotmail.com > Signed-off-by: Wei Wang <wei...@google.com> > Acked-by: Eric Dumazet <eduma...@google.com> Applied, thank you.
