diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2019-04-06 12:21:46 +0200 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2019-04-06 12:27:23 +0200 |
| commit | 477a63526047891990111604aaff456a6e54da68 (patch) | |
| tree | ee0c6182d5ba81ee4b0df6f542fabf9a7d13d360 /src/allowedips.c | |
| parent | compat: backport skb_mark_not_on_list (diff) | |
| download | wireguard-linux-compat-477a63526047891990111604aaff456a6e54da68.tar.xz wireguard-linux-compat-477a63526047891990111604aaff456a6e54da68.zip | |
allowedips: initialize list head when removing intermediate nodes
Otherwise if this list item is later reused, we'll crash on list poison
or worse.
Also, add a version of Mimka's reproducer to netns.sh to catch these
types of bugs in the future.
Reported-by: Mimka <mikma.wg@lists.m7n.se>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'src/allowedips.c')
| -rw-r--r-- | src/allowedips.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/allowedips.c b/src/allowedips.c index f175944..610aab0 100644 --- a/src/allowedips.c +++ b/src/allowedips.c @@ -108,7 +108,7 @@ static void walk_remove_by_peer(struct allowedips_node __rcu **top, if (rcu_dereference_protected(node->peer, lockdep_is_held(lock)) == peer) { RCU_INIT_POINTER(node->peer, NULL); - list_del(&node->peer_list); + list_del_init(&node->peer_list); if (!node->bit[0] || !node->bit[1]) { rcu_assign_pointer(*nptr, DEREF( &node->bit[!REF(node->bit[0])])); |