Commit 163db2c6 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman

ipv4: fix NULL dereference in free_fib_info_rcu()


[ Upstream commit 187e5b3a ]

If fi->fib_metrics could not be allocated in fib_create_info()
we attempt to dereference a NULL pointer in free_fib_info_rcu() :

    m = fi->fib_metrics;
    if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
            kfree(m);

Before my recent patch, we used to call kfree(NULL) and nothing wrong
happened.

Instead of using RCU to defer freeing while we are under memory stress,
it seems better to take immediate action.

This was reported by syzkaller team.

Fixes: 3fb07daf ("ipv4: add reference counting to metrics")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f1d05546
...@@ -1033,15 +1033,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg) ...@@ -1033,15 +1033,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL); fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
if (!fi) if (!fi)
goto failure; goto failure;
fib_info_cnt++;
if (cfg->fc_mx) { if (cfg->fc_mx) {
fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL); fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
if (!fi->fib_metrics) if (unlikely(!fi->fib_metrics)) {
goto failure; kfree(fi);
return ERR_PTR(err);
}
atomic_set(&fi->fib_metrics->refcnt, 1); atomic_set(&fi->fib_metrics->refcnt, 1);
} else } else {
fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics; fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
}
fib_info_cnt++;
fi->fib_net = net; fi->fib_net = net;
fi->fib_protocol = cfg->fc_protocol; fi->fib_protocol = cfg->fc_protocol;
fi->fib_scope = cfg->fc_scope; fi->fib_scope = cfg->fc_scope;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment