netdev - Re: [PATCH net-next] ipv6: add debug checks in fib6_info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 7 Dec 2023 11:26:40 -0700
From: David Ahern <dsahern@...nel.org>
To: Eric Dumazet <edumazet@...gle.com>, Kui-Feng Lee <sinquersw@...il.com>
Cc: patchwork-bot+netdevbpf@...nel.org, Kui-Feng Lee <thinker.li@...il.com>,
 davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net-next] ipv6: add debug checks in fib6_info_release()

On 12/7/23 11:25 AM, David Ahern wrote:
> On 12/7/23 11:22 AM, Eric Dumazet wrote:
>> Feel free to amend the patch, but the issue is that we insert a fib
>> gc_link to a list, then free the fi6 object without removing it first
>> from the external list.
> 
> yes, move the insert down:
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index b132feae3393..7257ba0e72b7 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -3762,12 +3762,6 @@ static struct fib6_info
> *ip6_route_info_create(struct fib6_config *cfg,
>         if (cfg->fc_flags & RTF_ADDRCONF)
>                 rt->dst_nocount = true;
> 
> -       if (cfg->fc_flags & RTF_EXPIRES)
> -               fib6_set_expires_locked(rt, jiffies +
> -
> clock_t_to_jiffies(cfg->fc_expires));
> -       else
> -               fib6_clean_expires_locked(rt);
> -
>         if (cfg->fc_protocol == RTPROT_UNSPEC)
>                 cfg->fc_protocol = RTPROT_BOOT;
>         rt->fib6_protocol = cfg->fc_protocol;
> @@ -3824,6 +3818,12 @@ static struct fib6_info
> *ip6_route_info_create(struct fib6_config *cfg,
>         } else
>                 rt->fib6_prefsrc.plen = 0;
> 
> +
> +       if (cfg->fc_flags & RTF_EXPIRES)
> +               fib6_set_expires_locked(rt, jiffies +
> +
> clock_t_to_jiffies(cfg->fc_expires));
> +       else
> +               fib6_clean_expires_locked(rt);
>         return rt;
>  out:
>         fib6_info_release(rt);


and then failure to insert into the table needs to remove it before the
release too.