]> git.baikalelectronics.ru Git - kernel.git/commit
ipv4: fix NULL dereference in free_fib_info_rcu()
authorEric Dumazet <edumazet@google.com>
Tue, 15 Aug 2017 12:26:17 +0000 (05:26 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 16 Aug 2017 00:07:52 +0000 (17:07 -0700)
commit183d73b1d10e7c3898dfb6d6b5f99c77369c8f7d
tree44a56af785355119f067c75a799d55fd3789ca86
parent907ca451a0f6b2ef96fddeb40db82e0c16dc02d5
ipv4: fix NULL dereference in free_fib_info_rcu()

If fi->fib_metrics could not be allocated in fib_create_info()
we attempt to dereference a NULL pointer in free_fib_info_rcu() :

    m = fi->fib_metrics;
    if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
            kfree(m);

Before my recent patch, we used to call kfree(NULL) and nothing wrong
happened.

Instead of using RCU to defer freeing while we are under memory stress,
it seems better to take immediate action.

This was reported by syzkaller team.

Fixes: 23a5f140b78b ("ipv4: add reference counting to metrics")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/fib_semantics.c