summaryrefslogtreecommitdiffstats
path: root/include/net
diff options
context:
space:
mode:
authorWANG Cong <xiyou.wangcong@gmail.com>2017-05-04 14:54:17 -0700
committerDavid S. Miller <davem@davemloft.net>2017-05-08 14:35:03 -0400
commit82486aa6f1b9bc8145e6d0fa2bc0b44307f3b875 (patch)
tree97674aade6f2ac755baebde5255a916028c50125 /include/net
parent3013c4983eb15f4ce8958e81922cdfd80f771d3e (diff)
downloadlinux-82486aa6f1b9bc8145e6d0fa2bc0b44307f3b875.tar.bz2
ipv4: restore rt->fi for reference counting
IPv4 dst could use fi->fib_metrics to store metrics but fib_info itself is refcnt'ed, so without taking a refcnt fi and fi->fib_metrics could be freed while dst metrics still points to it. This triggers use-after-free as reported by Andrey twice. This patch reverts commit 2860583fe840 ("ipv4: Kill rt->fi") to restore this reference counting. It is a quick fix for -net and -stable, for -net-next, as Eric suggested, we can consider doing reference counting for metrics itself instead of relying on fib_info. IPv6 is very different, it copies or steals the metrics from mx6_config in fib6_commit_metrics() so probably doesn't need a refcnt. Decnet has already done the refcnt'ing, see dn_fib_semantic_match(). Fixes: 2860583fe840 ("ipv4: Kill rt->fi") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
-rw-r--r--include/net/route.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/route.h b/include/net/route.h
index 2cc0e14c6359..4335eb72a04c 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -69,6 +69,7 @@ struct rtable {
struct list_head rt_uncached;
struct uncached_list *rt_uncached_list;
+ struct fib_info *fi; /* for refcnt to shared metrics */
};
static inline bool rt_is_input_route(const struct rtable *rt)