Re: [PATCH net] net: ipv6: regenerate host route if moved to gc list

2017-04-22 Thread David Ahern
On 4/22/17 3:14 AM, Dmitry Vyukov wrote: >> One small question. Why cmpxchg is needed instead >> of a ip6_rt_put() and then assign? >> Is it fixing another bug? > cmpxchg here looks fishy. > If there are no concurrent modifications, then it is not needed. > If there are and cmpxchg fails, then we

Re: [PATCH net] net: ipv6: regenerate host route if moved to gc list

2017-04-22 Thread Dmitry Vyukov
On Sat, Apr 22, 2017 at 7:57 AM, Martin KaFai Lau wrote: > On Fri, Apr 21, 2017 at 04:40:30PM -0700, David Ahern wrote: >> Taking down the loopback device wreaks havoc on IPv6 routes. By >> extension, taking a VRF device wreaks havoc on its table. >> >> Dmitry and Andrey both reported heap out-of-

Re: [PATCH net] net: ipv6: regenerate host route if moved to gc list

2017-04-21 Thread Martin KaFai Lau
On Fri, Apr 21, 2017 at 04:40:30PM -0700, David Ahern wrote: > Taking down the loopback device wreaks havoc on IPv6 routes. By > extension, taking a VRF device wreaks havoc on its table. > > Dmitry and Andrey both reported heap out-of-bounds reports in the IPv6 > FIB code while running syzkaller fu

[PATCH net] net: ipv6: regenerate host route if moved to gc list

2017-04-21 Thread David Ahern
Taking down the loopback device wreaks havoc on IPv6 routes. By extension, taking a VRF device wreaks havoc on its table. Dmitry and Andrey both reported heap out-of-bounds reports in the IPv6 FIB code while running syzkaller fuzzer. The root cause is a dead dst that is on the garbage list gets re