diff options
| author |   David Ahern <dsahern@gmail.com> | 2018-04-23 11:32:06 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-04-23 16:12:54 -0400 |
| commit | c3c14da0288de79ccef2c2380cf5737077fa64ed (patch) | |
| tree | 95fbbd5c0e179f628f9bd3b511acf56e658d3d46 /net/ipv6 | |
| parent | Merge branch 'qed-debug-data' (diff) | |
| download | linux-dev-c3c14da0288de79ccef2c2380cf5737077fa64ed.tar.xz linux-dev-c3c14da0288de79ccef2c2380cf5737077fa64ed.zip | |
net/ipv6: add rcu locking to ip6_negative_advice
syzbot reported a suspicious rcu_dereference_check:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x14a/0x153 kernel/locking/lockdep.c:4592
rt6_check_expired+0x38b/0x3e0 net/ipv6/route.c:410
ip6_negative_advice+0x67/0xc0 net/ipv6/route.c:2204
dst_negative_advice include/net/sock.h:1786 [inline]
sock_setsockopt+0x138f/0x1fe0 net/core/sock.c:1051
__sys_setsockopt+0x2df/0x390 net/socket.c:1899
SYSC_setsockopt net/socket.c:1914 [inline]
SyS_setsockopt+0x34/0x50 net/socket.c:1911
Add rcu locking around call to rt6_check_expired in
ip6_negative_advice.
Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
Reported-by: syzbot+2422c9e35796659d2273@syzkaller.appspotmail.com
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/route.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 0407bbc5a028..354a5b8d016f 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2201,10 +2201,12 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst) if (rt) { if (rt->rt6i_flags & RTF_CACHE) { + rcu_read_lock(); if (rt6_check_expired(rt)) { rt6_remove_exception_rt(rt); dst = NULL; } + rcu_read_unlock(); } else { dst_release(dst); dst = NULL; |