Message ID | 20170816181809.37073-1-tracywwnj@gmail.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Wei Wang <weiwan@google.com> Date: Wed, 16 Aug 2017 11:18:09 -0700 > From: Wei Wang <weiwan@google.com> > > syzcaller reported the following use-after-free issue in rt6_select(): ... > The root cause of it is that in fib6_add_rt2node(), when it replaces an > existing route with the new one, it does not update fn->rr_ptr. > This commit resets fn->rr_ptr to NULL when it points to a route which is > replaced in fib6_add_rt2node(). > > Fixes: 27596472473a ("ipv6: fix ECMP route replacement") > Signed-off-by: Wei Wang <weiwan@google.com> > Acked-by: Eric Dumazet <edumazet@google.com> Applied and queued up for -stable, thanks.
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 8c58c7558de0..78b9359b06fd 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1013,6 +1013,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, nsiblings = iter->rt6i_nsiblings; iter->rt6i_node = NULL; fib6_purge_rt(iter, fn, info->nl_net); + if (fn->rr_ptr == iter) + fn->rr_ptr = NULL; rt6_release(iter); if (nsiblings) { @@ -1026,6 +1028,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, *ins = iter->dst.rt6_next; iter->rt6i_node = NULL; fib6_purge_rt(iter, fn, info->nl_net); + if (fn->rr_ptr == iter) + fn->rr_ptr = NULL; rt6_release(iter); nsiblings--; } else {