From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [Patch net] ipv4: restore rt->fi for reference counting Date: Mon, 08 May 2017 14:35:57 -0400 (EDT) Message-ID: <20170508.143557.105629611489969352.davem@davemloft.net> References: <1493934857-6693-1-git-send-email-xiyou.wangcong@gmail.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, andreyknvl@google.com, edumazet@google.com To: xiyou.wangcong@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:33886 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751350AbdEHSgB (ORCPT ); Mon, 8 May 2017 14:36:01 -0400 In-Reply-To: <1493934857-6693-1-git-send-email-xiyou.wangcong@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Cong Wang Date: Thu, 4 May 2017 14:54:17 -0700 > IPv4 dst could use fi->fib_metrics to store metrics but fib_info > itself is refcnt'ed, so without taking a refcnt fi and > fi->fib_metrics could be freed while dst metrics still points to > it. This triggers use-after-free as reported by Andrey twice. > > This patch reverts commit 2860583fe840 ("ipv4: Kill rt->fi") to > restore this reference counting. It is a quick fix for -net and > -stable, for -net-next, as Eric suggested, we can consider doing > reference counting for metrics itself instead of relying on fib_info. > > IPv6 is very different, it copies or steals the metrics from mx6_config > in fib6_commit_metrics() so probably doesn't need a refcnt. > > Decnet has already done the refcnt'ing, see dn_fib_semantic_match(). > > Fixes: 2860583fe840 ("ipv4: Kill rt->fi") > Reported-by: Andrey Konovalov > Tested-by: Andrey Konovalov > Signed-off-by: Cong Wang Applied and queued up for -stable, thanks.