Messages in this thread | | | Subject | Re: net/ipv4: use-after-free in ipv4_mtu | From | Eric Dumazet <> | Date | Thu, 06 Apr 2017 03:49:10 -0700 |
| |
On Wed, 2017-04-05 at 15:33 -0700, Cong Wang wrote:
> Good find! I missed the refcnt in rt_set_nexthop() before that commit. > > We need to revert that commit to restore the refcnt for fib_info.
Well, there are other spots , in decnet and IPv6.
This is why my original mail stated the problem was in the calls to :
dst_init_metrics(&rt->dst, fi->fib_metrics, true);
Lets do not think in "reverting" spirit, but adding the missing bits.
The problem here is that the metrics should not be freed until last user is gone.
So maybe a refcount should be added to metrics, and we do not have to add a fib pointer again in all dsts.
Thanks.
| |