diff options
| author | David Ahern <dsahern@kernel.org> | 2023-12-19 04:02:43 +0100 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2023-12-21 09:01:30 +0100 |
| commit | dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec (patch) | |
| tree | 3c9e907295834f60ddcabd8d446786fe4ac13ff2 /net/ipv6/route.c | |
| parent | Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/... (diff) | |
| download | linux-dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec.tar.xz linux-dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec.zip | |
net/ipv6: Revert remove expired routes with a separated list of routes
This reverts commit 3dec89b14d37ee635e772636dad3f09f78f1ab87.
The commit has some race conditions given how expires is managed on a
fib6_info in relation to gc start, adding the entry to the gc list and
setting the timer value leading to UAF. Revert the commit and try again
in a later release.
Fixes: 3dec89b14d37 ("net/ipv6: Remove expired routes with a separated list of routes")
Cc: Kui-Feng Lee <thinker.li@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231219030243.25687-1-dsahern@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/ipv6/route.c')
| -rw-r--r-- | net/ipv6/route.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index b132feae3393..ea1dec8448fc 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -3763,10 +3763,10 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, rt->dst_nocount = true; if (cfg->fc_flags & RTF_EXPIRES) - fib6_set_expires_locked(rt, jiffies + - clock_t_to_jiffies(cfg->fc_expires)); + fib6_set_expires(rt, jiffies + + clock_t_to_jiffies(cfg->fc_expires)); else - fib6_clean_expires_locked(rt); + fib6_clean_expires(rt); if (cfg->fc_protocol == RTPROT_UNSPEC) cfg->fc_protocol = RTPROT_BOOT; |