* Re: [IPv6] crashed when __ip6_del_rt()
[not found] ` <BAY173-W14E9D67B7924486F0518F0B0310-MsuGFMq8XAE@public.gmane.org>
@ 2012-12-18 12:05 ` YOSHIFUJI Hideaki
0 siblings, 0 replies; only message in thread
From: YOSHIFUJI Hideaki @ 2012-12-18 12:05 UTC (permalink / raw)
To: stanley zhou
Cc: davem-fT/PcQaiUtIeIZ0/mPfg9Q, w.sang-bIcnvbaLZ9MEGnE8C9+IrQ,
laurent.navet-Re5JQEeQqe8AvxtiuMwx3w,
ben-linux-elnMNo+KYs3YtjvyW6yDsg,
linux-i2c-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA, khali-PUYAD+kWke1g9hUCZPvPmw,
firedtoad-Re5JQEeQqe8AvxtiuMwx3w, YOSHIFUJI Hideaki
stanley zhou wrote:
> when call write_lock_bh() table is null cause crash in __ip6_del_rt().
> kernel version is 2.6.30.10
:
> static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
> {
> int err;
> struct fib6_table *table;
> struct net *net = dev_net(rt->rt6i_dev);
>
> if (rt == net->ipv6.ip6_null_entry) {
> +++err = -ENOENT;
> +++goto out;
> --- return -ENOENT;
> }
>
> table = rt->rt6i_table;
> write_lock_bh(&table->tb6_lock);
> err = fib6_del(rt, info);
> write_unlock_bh(&table->tb6_lock);
> +++out:
> dst_release(&rt->u.dst);
> return err;
> }
>
I think this is what commit 6825a26c ("ipv6: release reference of
ip6_null_entry's dst entry in __ip6_del_rt") by Gao feng
<gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org> does, which is already in v3.7.
Are you suggesting that we should have this in -stable tree as well?
--yoshfuji
^ permalink raw reply [flat|nested] only message in thread