Commit 9ca562bb authored by Zhengchuan Liang's avatar Zhengchuan Liang Committed by Jakub Kicinski
Browse files

net: ipv6: flowlabel: defer exclusive option free until RCU teardown 



`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt->opt_nflen` when an option block
is present.

Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`
drops to zero in `fl_release()`. However, the surrounding
`struct ip6_flowlabel` remains visible in the global hash table until
later garbage collection removes it and `fl_free_rcu()` finally tears it
down.

A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that
early `kfree()` and dereference freed option state, triggering a crash
in `ip6fl_seq_show()`.

Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches
the lifetime already required for the enclosing flowlabel while readers
can still reach it under RCU.

Fixes: d3aedd5e ("ipv6 flowlabel: Convert hash list to RCU.")
Reported-by: default avatarYifan Wu <yifanwucs@gmail.com>
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Co-developed-by: default avatarYuan Tan <yuantan098@gmail.com>
Signed-off-by: default avatarYuan Tan <yuantan098@gmail.com>
Suggested-by: default avatarXin Liu <bird@lzu.edu.cn>
Tested-by: default avatarRen Wei <enjou1224z@gmail.com>
Signed-off-by: default avatarZhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: default avatarRen Wei <n05ec@lzu.edu.cn>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/07351f0ec47bcee289576f39f9354f4a64add6e4.1774855883.git.zcliangcn@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent fa6e2496

net/ipv6/ip6_flowlabel.c

+0 −5
Original line number Diff line number Diff line
@@ -133,11 +133,6 @@ static void fl_release(struct ip6_flowlabel *fl) 
		if (time_after(ttd, fl->expires))

			fl->expires = ttd;

		ttd = fl->expires;

		if (fl->opt && fl->share == IPV6_FL_S_EXCL) {

			struct ipv6_txoptions *opt = fl->opt;

			fl->opt = NULL;

			kfree(opt);

		}

		if (!timer_pending(&ip6_fl_gc_timer) ||

		    time_after(ip6_fl_gc_timer.expires, ttd))

			mod_timer(&ip6_fl_gc_timer, ttd);