WANG Cong e252b3d1a1 route: fix a use-after-free ... This patch fixes the following crash: general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000 RIP: 0010:[<ffffffff8182f91b>] [<ffffffff8182f91b>] dst_destroy+0xa6/0xef RSP: 0018:ffff880107603e38 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0 RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001 R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000 R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f FS: 0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0 Stack: ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000 ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280 Call Trace: <IRQ> [<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d [<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb [<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb [<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb [<ffffffff8107e11b>] __do_softirq+0x178/0x39f [<ffffffff8107e52e>] irq_exit+0x41/0x95 [<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40 [<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80 <EOI> [<ffffffff8100b968>] ? default_idle+0x21/0x32 [<ffffffff8100b966>] ? default_idle+0x1f/0x32 [<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11 [<ffffffff810b0bc7>] default_idle_call+0x1f/0x21 [<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273 [<ffffffff8102fe67>] start_secondary+0x135/0x156 dst is freed right before lwtstate_put(), this is not correct... Fixes: 61adedf3e3 ("route: move lwtunnel state to dst_entry") Acked-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-08-25 14:29:19 -07:00
..
datagram.c	net: Fix skb_set_peeked use-after-free bug	2015-08-06 21:55:47 -07:00
dev_addr_lists.c	net: fix spelling for synchronized	2014-11-18 15:26:32 -05:00
dev_ioctl.c	dev_ioctl: use sizeof(x) instead of sizeof x	2014-11-18 15:27:32 -05:00
dev.c	net: warn if drivers set tx_queue_len = 0	2015-08-18 11:55:08 -07:00
drop_monitor.c	net: Replace get_cpu_var through this_cpu_ptr	2014-08-26 13:45:47 -04:00
dst.c	route: fix a use-after-free	2015-08-25 14:29:19 -07:00
ethtool.c	net/ethtool: Add current supported tunable options	2015-06-11 00:36:37 -07:00
fib_rules.c	fib: Add fib rule match on tunnel id	2015-07-21 10:39:06 -07:00
filter.c	route: move lwtunnel state to dst_entry	2015-08-20 15:42:36 -07:00
flow_dissector.c	net: Add functions to get skb->hash based on flow structures	2015-07-31 17:07:11 -07:00
flow.c	flowcache: Fix kernel panic in flow_cache_flush_task	2015-02-05 14:38:53 -08:00
gen_estimator.c	net_sched: gen_estimator: extend pps limit	2015-07-08 13:59:20 -07:00
gen_stats.c	gen_stats.c: Duplicate xstats buffer for later use	2015-02-19 15:45:53 -05:00
link_watch.c	dev: introduce dev_get_iflink()	2015-04-02 14:04:59 -04:00
lwtunnel.c	lwt: Add cfg argument to build_state	2015-08-24 10:34:40 -07:00
Makefile	lwtunnel: infrastructure for handling light weight tunnels like mpls	2015-07-21 10:39:03 -07:00
neighbour.c	net: add explicit logging and stat for neighbour table overflow	2015-08-10 13:46:21 -07:00
net_namespace.c	netns: make nsid_lock per net	2015-05-17 23:41:11 -04:00
net-procfs.c	rps: selective flow shedding during softnet overflow	2013-05-20 13:48:04 -07:00
net-sysfs.c	net: allow sleeping when modifying store_rps_map	2015-08-13 21:40:57 -07:00
net-sysfs.h	net: netdev_kobject_init: annotate with __init	2014-01-05 20:27:54 -05:00
net-traces.c	net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules	2011-10-31 19:30:30 -04:00
netclassid_cgroup.c	cgroup: net_cls: fix false-positive "suspicious RCU usage"	2015-07-25 00:13:18 -07:00
netevent.c	netevent: remove automatic variable in register_netevent_notifier()	2015-05-31 00:03:21 -07:00
netpoll.c	net: rename vlan_tx_* helpers since "tx" is misleading there	2015-01-13 17:51:08 -05:00
netprio_cgroup.c	cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes	2014-07-15 11:05:09 -04:00
pktgen.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-08-13 16:23:11 -07:00
ptp_classifier.c	net: filter: split 'struct sk_filter' into socket and bpf parts	2014-08-02 15:03:58 -07:00
request_sock.c	inet: fix races with reqsk timers	2015-08-10 21:17:29 -07:00
rtnetlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-07-23 00:41:16 -07:00
scm.c	net: introduce helper macro for_each_cmsghdr	2014-12-10 22:41:55 -05:00
secure_seq.c	net: remove a sparse error in secure_dccpv6_sequence_number()	2015-05-25 22:55:37 -04:00
skbuff.c	net-next: Fix warning while make xmldocs caused by skbuff.c	2015-08-25 14:20:48 -07:00
sock_diag.c	sock_diag: define destruction multicast groups	2015-06-15 19:49:22 -07:00
sock.c	net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket	2015-07-30 15:59:12 -07:00
stream.c	tcp: set SOCK_NOSPACE under memory pressure	2015-05-09 17:38:36 -04:00
sysctl_net_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-03-20 18:51:09 -04:00
timestamping.c	net: skb_defer_rx_timestamp should check for phydev before setting up classify	2015-07-09 14:17:15 -07:00
tso.c	net: tso: fix unaligned access to crafted TCP header in helper API	2014-10-22 12:52:55 -04:00
utils.c	net: Add inet_proto_csum_replace_by_diff utility function	2015-08-17 21:33:06 -07:00