[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <28f016bc-3514-444f-82df-719aeb2d013a@kernel.org>
Date: Wed, 13 Dec 2023 22:11:24 -0800
From: David Ahern <dsahern@...nel.org>
To: thinker.li@...il.com, netdev@...r.kernel.org, martin.lau@...ux.dev,
kernel-team@...a.com, davem@...emloft.net, kuba@...nel.org,
pabeni@...hat.com, edumazet@...gle.com
Cc: sinquersw@...il.com, kuifeng@...a.com,
syzbot+c15aa445274af8674f41@...kaller.appspotmail.com
Subject: Re: [PATCH net-next v3 1/2] net/ipv6: insert a f6i to a GC list only
if the f6i is in a fib6_table tree.
On 12/13/23 2:37 PM, thinker.li@...il.com wrote:
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index b132feae3393..dcaeb88d73aa 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -3763,10 +3763,10 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
> rt->dst_nocount = true;
>
> if (cfg->fc_flags & RTF_EXPIRES)
> - fib6_set_expires_locked(rt, jiffies +
> - clock_t_to_jiffies(cfg->fc_expires));
> + __fib6_set_expires(rt, jiffies +
> + clock_t_to_jiffies(cfg->fc_expires));
> else
> - fib6_clean_expires_locked(rt);
> + __fib6_clean_expires(rt);
as Eric noted in a past comment, the clean is not needed in this
function since memory is initialized to 0 (expires is never set).
Also, this patch set does not fundamentally change the logic, so it
cannot fix the bug reported in
https://lore.kernel.org/all/20231205173250.2982846-1-edumazet@google.com/
please hold off future versions of this set until the problem in that
stack traced is fixed. I have tried a few things using RA's, but have
not been able to recreate UAF.
Powered by blists - more mailing lists