• Daniel Borkmann's avatar
    net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference · 0409c9a5
    Daniel Borkmann authored
    When IPv6 host routes with metrics attached are being added, we fetch
    the metrics store from the dst via COW through dst_metrics_write_ptr(),
    added through commit e5fd387a.
    
    One remaining problem here is that we actually call into inet_getpeer()
    and may end up allocating/creating a new peer from the kmemcache, which
    may fail.
    
    Example trace from perf probe (inet_getpeer:41) where create is 1:
    
    ip 6877 [002] 4221.391591: probe:inet_getpeer: (ffffffff8165e293)
      85e294 inet_getpeer.part.7 (<- kmem_cache_alloc())
      85e578 inet_getpeer
      8eb333 ipv6_cow_metrics
      8f10ff fib6_commit_metrics
    
    Therefore, a check for NULL on the return of dst_metrics_write_ptr()
    is necessary here.
    
    Joint work with Florian Westphal.
    
    Fixes: e5fd387a ("ipv6: do not overwrite inetpeer metrics prematurely")
    Cc: Michal Kubeček <mkubecek@suse.cz>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    0409c9a5
ip6_fib.c 42.8 KB