diff mbox series

ila: Fix rhashtable walker list corruption

Message ID 20190326055014.3ck2xvx6v5zaimf3@gondor.apana.org.au
State Accepted
Delegated to: David Miller
Headers show
Series ila: Fix rhashtable walker list corruption | expand

Commit Message

Herbert Xu March 26, 2019, 5:50 a.m. UTC 
ila_xlat_nl_cmd_flush uses rhashtable walkers allocated from the
stack but it never frees them.  This corrupts the walker list of
the hash table.

This patch fixes it.

Reported-by: syzbot+dae72a112334aa65a159@syzkaller.appspotmail.com
Fixes: b6e71bdebb12 ("ila: Flush netlink command to clear xlat...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Comments

David Miller March 28, 2019, 5:47 a.m. UTC | #1 
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 26 Mar 2019 13:50:14 +0800

> ila_xlat_nl_cmd_flush uses rhashtable walkers allocated from the
> stack but it never frees them.  This corrupts the walker list of
> the hash table.
> 
> This patch fixes it.
> 
> Reported-by: syzbot+dae72a112334aa65a159@syzkaller.appspotmail.com
> Fixes: b6e71bdebb12 ("ila: Flush netlink command to clear xlat...")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied and queued up for -stable, thanks Herbert.
diff mbox series

Patch

diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 79d2e43c05c5..5fc1f4e0c0cf 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -417,6 +417,7 @@  int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
 
 done:
 	rhashtable_walk_stop(&iter);
+	rhashtable_walk_exit(&iter);
 	return ret;
 }