From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: [PATCH net-next 8/8] net/ipv6: Fix gfp_flags arg to addrconf_prefix_route Date: Wed, 18 Apr 2018 15:39:06 -0700 Message-ID: <20180418223906.16650-9-dsahern@gmail.com> References: <20180418223906.16650-1-dsahern@gmail.com> Cc: davem@davemloft.net, idosch@idosch.org, roopa@cumulusnetworks.com, eric.dumazet@gmail.com, weiwan@google.com, kafai@fb.com, yoshfuji@linux-ipv6.org, David Ahern To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:45061 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753050AbeDRWj1 (ORCPT ); Wed, 18 Apr 2018 18:39:27 -0400 Received: by mail-pg0-f65.google.com with SMTP id i29so24876pgn.12 for ; Wed, 18 Apr 2018 15:39:27 -0700 (PDT) In-Reply-To: <20180418223906.16650-1-dsahern@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: Eric noticed that __ipv6_ifa_notify is called under rcu_read_lock, so the gfp argument to addrconf_prefix_route can not be GFP_KERNEL. While scrubbing other calls I noticed addrconf_addr_gen has one place with GFP_ATOMIC that can be GFP_KERNEL. Fixes: acb54e3cba404 ("net/ipv6: Add gfp_flags to route add functions") Reported-by: syzbot+2add39b05179b31f912f@syzkaller.appspotmail.com Reported-by: Eric Dumazet Signed-off-by: David Ahern --- net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 6c42c5d5fafa..7b4d7bbf2c17 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -3245,7 +3245,7 @@ static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route) addrconf_add_linklocal(idev, &addr, 0); else if (prefix_route) addrconf_prefix_route(&addr, 64, idev->dev, - 0, 0, GFP_ATOMIC); + 0, 0, GFP_KERNEL); break; case IN6_ADDR_GEN_MODE_NONE: default: @@ -5620,7 +5620,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) if (!ipv6_addr_any(&ifp->peer_addr)) addrconf_prefix_route(&ifp->peer_addr, 128, ifp->idev->dev, 0, 0, - GFP_KERNEL); + GFP_ATOMIC); break; case RTM_DELADDR: if (ifp->idev->cnf.forwarding) -- 2.11.0