[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231207201322.549000-1-edumazet@google.com>
Date: Thu, 7 Dec 2023 20:13:22 +0000
From: Eric Dumazet <edumazet@...gle.com>
To: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>
Cc: David Ahern <dsahern@...nel.org>, netdev@...r.kernel.org, eric.dumazet@...il.com,
Eric Dumazet <edumazet@...gle.com>, syzbot+c15aa445274af8674f41@...kaller.appspotmail.com,
Kui-Feng Lee <thinker.li@...il.com>
Subject: [PATCH net-next] ipv6: do not check fib6_has_expires() in fib6_info_release()
My prior patch went a bit too far, because apparently fib6_has_expires()
could be true while f6i->gc_link is not hashed yet.
fib6_set_expires_locked() can indeed set RTF_EXPIRES
while f6i->fib6_table is NULL.
Original syzbot reports were about corruptions caused
by dangling f6i->gc_link.
Fixes: 5a08d0065a91 ("ipv6: add debug checks in fib6_info_release()")
Reported-by: syzbot+c15aa445274af8674f41@...kaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@...gle.com>
Cc: David Ahern <dsahern@...nel.org>
Cc: Kui-Feng Lee <thinker.li@...il.com>
---
include/net/ip6_fib.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index e1e7a894863a7891610ce5afb2034473cc208d3e..95ed495c3a4028457baf1503c367d2e7a6e14770 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -329,7 +329,6 @@ static inline bool fib6_info_hold_safe(struct fib6_info *f6i)
static inline void fib6_info_release(struct fib6_info *f6i)
{
if (f6i && refcount_dec_and_test(&f6i->fib6_ref)) {
- DEBUG_NET_WARN_ON_ONCE(fib6_has_expires(f6i));
DEBUG_NET_WARN_ON_ONCE(!hlist_unhashed(&f6i->gc_link));
call_rcu(&f6i->rcu, fib6_info_destroy_rcu);
}
--
2.43.0.472.g3155946c3a-goog
Powered by blists - more mailing lists