From: Eric Dumazet <eric.duma...@gmail.com> Date: Mon, 02 Nov 2015 09:03:11 -0800
> From: Eric Dumazet <eduma...@google.com> > > This patch fixes following problems : > > 1) percpu_counter_init() can return an error, therefore > init_frag_mem_limit() must propagate this error so that > inet_frags_init_net() can do the same up to its callers. > > 2) If ip[46]_frags_ns_ctl_register() fail, we must unwind > properly and free the percpu_counter. > > Without this fix, we leave freed object in percpu_counters > global list (if CONFIG_HOTPLUG_CPU) leading to crashes. > > This bug was detected by KASAN and syzkaller tool > (http://github.com/google/syzkaller) > > Fixes: 6d7b857d541e ("net: use lib/percpu_counter API for fragmentation mem > accounting") > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: Dmitry Vyukov <dvyu...@google.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
