* [PATCH] ila: Fix rhashtable walker list corruption
@ 2019-03-26 5:50 Herbert Xu
2019-03-28 5:47 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Herbert Xu @ 2019-03-26 5:50 UTC (permalink / raw)
To: David S. Miller, netdev; +Cc: Tom Herbert, Tom Herbert
ila_xlat_nl_cmd_flush uses rhashtable walkers allocated from the
stack but it never frees them. This corrupts the walker list of
the hash table.
This patch fixes it.
Reported-by: syzbot+dae72a112334aa65a159@syzkaller.appspotmail.com
Fixes: b6e71bdebb12 ("ila: Flush netlink command to clear xlat...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 79d2e43c05c5..5fc1f4e0c0cf 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -417,6 +417,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
done:
rhashtable_walk_stop(&iter);
+ rhashtable_walk_exit(&iter);
return ret;
}
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ila: Fix rhashtable walker list corruption
2019-03-26 5:50 [PATCH] ila: Fix rhashtable walker list corruption Herbert Xu
@ 2019-03-28 5:47 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-03-28 5:47 UTC (permalink / raw)
To: herbert; +Cc: netdev, tom, tom
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 26 Mar 2019 13:50:14 +0800
> ila_xlat_nl_cmd_flush uses rhashtable walkers allocated from the
> stack but it never frees them. This corrupts the walker list of
> the hash table.
>
> This patch fixes it.
>
> Reported-by: syzbot+dae72a112334aa65a159@syzkaller.appspotmail.com
> Fixes: b6e71bdebb12 ("ila: Flush netlink command to clear xlat...")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied and queued up for -stable, thanks Herbert.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-28 5:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-26 5:50 [PATCH] ila: Fix rhashtable walker list corruption Herbert Xu
2019-03-28 5:47 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.