From: Wei Wang <[email protected]> Date: Sat, 21 Jul 2018 20:56:32 -0700
> From: Wei Wang <[email protected]> > > In the code path where only rcu read lock is held, e.g. in the route > lookup code path, it is not safe to directly call fib6_info_hold() > because the fib6_info may already have been deleted but still exists > in the rcu grace period. Holding reference to it could cause double > free and crash the kernel. > > This patch adds a new function fib6_info_hold_safe() and replace > fib6_info_hold() in all necessary places. > > Syzbot reported 3 crash traces because of this. One of them is: ... > Fixes: 93531c674315 (net/ipv6: separate handling of FIB entries from dst > based routes) > Reported-by: [email protected] > Reported-by: [email protected] > Reported-by: [email protected] > Signed-off-by: Wei Wang <[email protected]> > Acked-by: Eric Dumazet <[email protected]> Applied, thank you.
