netdev - [PATCH net-next] net: check type when freeing metadata dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170818123135.518080-1-equinox@diac24.net>
Date:   Fri, 18 Aug 2017 14:31:35 +0200
From:   David Lamparter <equinox@...c24.net>
To:     netdev@...r.kernel.org
Cc:     David Lamparter <equinox@...c24.net>,
        Jakub Kicinski <jakub.kicinski@...ronome.com>,
        Sridhar Samudrala <sridhar.samudrala@...el.com>,
        Simon Horman <horms@...ge.net.au>,
        "David S . Miller" <davem@...emloft.net>
Subject: [PATCH net-next] net: check type when freeing metadata dst

Commit 3fcece12bc1b ("net: store port/representator id in metadata_dst")
added a new type field to metadata_dst, but metadata_dst_free() wasn't
updated to check it before freeing the METADATA_IP_TUNNEL specific dst
cache entry.

This is not currently causing problems since it's far enough back in the
struct to be zeroed for the only other type currently in existance
(METADATA_HW_PORT_MUX), but nevertheless it's not correct.

Fixes: 3fcece12bc1b ("net: store port/representator id in metadata_dst")
Signed-off-by: David Lamparter <equinox@...c24.net>
Cc: Jakub Kicinski <jakub.kicinski@...ronome.com>
Cc: Sridhar Samudrala <sridhar.samudrala@...el.com>
Cc: Simon Horman <horms@...ge.net.au>
Cc: David S. Miller <davem@...emloft.net>
---
 net/core/dst.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/dst.c b/net/core/dst.c
index 00aa972ad1a1..7954d1710d97 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -299,7 +299,8 @@ EXPORT_SYMBOL_GPL(metadata_dst_alloc);
 void metadata_dst_free(struct metadata_dst *md_dst)
 {
 #ifdef CONFIG_DST_CACHE
-	dst_cache_destroy(&md_dst->u.tun_info.dst_cache);
+	if (md_dst->type == METADATA_IP_TUNNEL)
+		dst_cache_destroy(&md_dst->u.tun_info.dst_cache);
 #endif
 	kfree(md_dst);
 }
-- 
2.13.0