WANG Cong e252b3d1a1 route: fix a use-after-free ... This patch fixes the following crash: general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc7+ #166 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88010656d280 ti: ffff880106570000 task.ti: ffff880106570000 RIP: 0010:[<ffffffff8182f91b>] [<ffffffff8182f91b>] dst_destroy+0xa6/0xef RSP: 0018:ffff880107603e38 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8800d225a000 RCX: ffffffff82250fd0 RDX: 0000000000000001 RSI: ffffffff82250fd0 RDI: 6b6b6b6b6b6b6b6b RBP: ffff880107603e58 R08: 0000000000000001 R09: 0000000000000001 R10: 000000000000b530 R11: ffff880107609000 R12: 0000000000000000 R13: ffffffff82343c40 R14: 0000000000000000 R15: ffffffff8182fb4f FS: 0000000000000000(0000) GS:ffff880107600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fcabd9d3000 CR3: 00000000d7279000 CR4: 00000000000006e0 Stack: ffffffff82250fd0 ffff8801077d6f00 ffffffff82253c40 ffff8800d225a000 ffff880107603e68 ffffffff8182fb5d ffff880107603f08 ffffffff810d795e ffffffff810d7648 ffff880106574000 ffff88010656d280 ffff88010656d280 Call Trace: <IRQ> [<ffffffff8182fb5d>] dst_destroy_rcu+0xe/0x1d [<ffffffff810d795e>] rcu_process_callbacks+0x618/0x7eb [<ffffffff810d7648>] ? rcu_process_callbacks+0x302/0x7eb [<ffffffff8182fb4f>] ? dst_gc_task+0x1eb/0x1eb [<ffffffff8107e11b>] __do_softirq+0x178/0x39f [<ffffffff8107e52e>] irq_exit+0x41/0x95 [<ffffffff81a4f215>] smp_apic_timer_interrupt+0x34/0x40 [<ffffffff81a4d5cd>] apic_timer_interrupt+0x6d/0x80 <EOI> [<ffffffff8100b968>] ? default_idle+0x21/0x32 [<ffffffff8100b966>] ? default_idle+0x1f/0x32 [<ffffffff8100bf19>] arch_cpu_idle+0xf/0x11 [<ffffffff810b0bc7>] default_idle_call+0x1f/0x21 [<ffffffff810b0dce>] cpu_startup_entry+0x1ad/0x273 [<ffffffff8102fe67>] start_secondary+0x135/0x156 dst is freed right before lwtstate_put(), this is not correct... Fixes: 61adedf3e3 ("route: move lwtunnel state to dst_entry") Acked-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-08-25 14:29:19 -07:00
..
6lowpan	6lowpan: move module_init into core functionality	2015-08-11 22:05:36 +02:00
9p	virtio/vhost: fixes for 4.2	2015-07-23 13:07:04 -07:00
802
8021q	net: 8021q: convert to using IFF_NO_QUEUE	2015-08-18 11:55:06 -07:00
appletalk
atm	br2684: Remove unnecessary formatting macros b1 and bs	2015-07-31 15:25:52 -07:00
ax25	NET: AX.25: Stop heartbeat timer on disconnect.	2015-07-15 15:59:58 -07:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-08-21 11:44:04 -07:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next	2015-08-17 15:41:21 -07:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-08-21 11:44:04 -07:00
caif	net: caif: convert to using IFF_NO_QUEUE	2015-08-18 11:55:07 -07:00
can	can: replace timestamp as unique skb attribute	2015-07-12 21:13:22 +02:00
ceph	libceph: treat sockaddr_storage with uninitialized family as blank	2015-07-09 20:30:34 +03:00
core	route: fix a use-after-free	2015-08-25 14:29:19 -07:00
dcb
dccp	tcp: fix recv with flags MSG_WAITALL | MSG_PEEK	2015-07-27 01:06:53 -07:00
decnet
dns_resolver
dsa	net: dsa: Allow multi hop routes to be expressed	2015-08-18 14:17:21 -07:00
ethernet	net: ethernet: Fix double word "the the" in eth.c	2015-08-09 22:53:00 -07:00
hsr	net: hsr: convert to using IFF_NO_QUEUE	2015-08-18 11:55:07 -07:00
ieee802154	net: 6lowpan: convert to using IFF_NO_QUEUE	2015-08-18 11:55:06 -07:00
ipv4	ah4: Fix error return in ah_input().	2015-08-25 13:38:50 -07:00
ipv6	ah6: fix error return code	2015-08-25 13:37:31 -07:00
ipx
irda	irda: use msecs_to_jiffies for conversion to jiffies	2015-05-25 17:46:21 -04:00
iucv
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-06-24 16:49:49 -07:00
l2tp
lapb
llc	tcp: fix recv with flags MSG_WAITALL | MSG_PEEK	2015-07-27 01:06:53 -07:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-08-21 11:44:04 -07:00
mac802154	ieee802154: add ack request default handling	2015-08-10 20:43:06 +02:00
mpls	lwt: Add cfg argument to build_state	2015-08-24 10:34:40 -07:00
netfilter	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-08-21 06:09:05 +02:00
netlabel
netlink	netlink: make sure -EBUSY won't escape from netlink_insert	2015-08-10 10:59:10 -07:00
netrom	netfilter: Remove spurios included of netfilter.h	2015-06-18 21:14:32 +02:00
nfc	nfc: netlink: Add capability to reply to vendor_cmd with data	2015-08-20 22:00:11 +02:00
openvswitch	route: move lwtunnel state to dst_entry	2015-08-20 15:42:36 -07:00
packet	packet: add extended BPF fanout mode	2015-08-17 14:22:48 -07:00
phonet
rds	RDS: check for valid cm_id before initiating connection	2015-08-25 13:35:31 -07:00
rfkill	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next	2015-08-17 15:41:21 -07:00
rose	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-06-24 02:58:51 -07:00
rxrpc
sched	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-08-21 06:09:05 +02:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-07-31 23:52:20 -07:00
sunrpc	NFS client bugfixes for Linux 4.2	2015-07-28 09:37:44 -07:00
switchdev	net: switchdev: support static FDB addresses	2015-08-11 12:03:19 -07:00
tipc	tipc: fix stale link problem during synchronization	2015-08-23 16:14:45 -07:00
unix	net/unix: support SCM_SECURITY for stream sockets	2015-06-10 22:49:20 -07:00
vmw_vsock
wimax	net:wimax: Fix doucble word "the the" in networking.xml	2015-08-09 22:43:52 -07:00
wireless	nl80211: Allow setting multicast rate on OCB interfaces	2015-08-14 17:49:48 +02:00
x25
xfrm	xfrm: Add oif to dst lookups	2015-08-11 12:41:35 +02:00
compat.c
Kconfig	lwtunnel: infrastructure for handling light weight tunnels like mpls	2015-07-21 10:39:03 -07:00
Makefile
socket.c
sysctl_net.c