Messages in this thread | | | Date | Tue, 14 Jun 2022 17:46:02 +0300 | From | Dan Carpenter <> | Subject | Re: [syzbot] WARNING: ODEBUG bug in route4_destroy |
| |
On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote: > > This looks like route4_destroy is deleting the 'fold' which has been > freed by tcf_queue_work in route4_change. It means 'fold' is still in > the table. > I have tested this patch on syzbot and it works well, but I am not > sure whether it will introduce other issues... > > diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c > index a35ab8c27866..758c21f9d628 100644 > --- a/net/sched/cls_route.c > +++ b/net/sched/cls_route.c > @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, > rcu_assign_pointer(f->next, f1); > rcu_assign_pointer(*fp, f); > > - if (fold && fold->handle && f->handle != fold->handle) { > + if (fold && f->handle != fold->handle) { ^^^^^^^^^^^^ There is still a dereference here so your patch doesn't make sense. :/
regards, dan carpenter
> th = to_hash(fold->handle); > h = from_hash(fold->handle >> 16); > b = rtnl_dereference(head->table[th]); > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0c0468ae-5fe3-a71f-c987-18475756caca%40huawei.com.
| |