From: Eric Dumazet Date: Thu, 7 Dec 2023 20:13:22 +0000 (+0000) Subject: ipv6: do not check fib6_has_expires() in fib6_info_release() X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=a3c205d0560f63ff02516b6d9fc3348dc34251c8;p=linux.git ipv6: do not check fib6_has_expires() in fib6_info_release() My prior patch went a bit too far, because apparently fib6_has_expires() could be true while f6i->gc_link is not hashed yet. fib6_set_expires_locked() can indeed set RTF_EXPIRES while f6i->fib6_table is NULL. Original syzbot reports were about corruptions caused by dangling f6i->gc_link. Fixes: 5a08d0065a91 ("ipv6: add debug checks in fib6_info_release()") Reported-by: syzbot+c15aa445274af8674f41@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Kui-Feng Lee Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231207201322.549000-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h index e1e7a894863a7..95ed495c3a402 100644 --- a/include/net/ip6_fib.h +++ b/include/net/ip6_fib.h @@ -329,7 +329,6 @@ static inline bool fib6_info_hold_safe(struct fib6_info *f6i) static inline void fib6_info_release(struct fib6_info *f6i) { if (f6i && refcount_dec_and_test(&f6i->fib6_ref)) { - DEBUG_NET_WARN_ON_ONCE(fib6_has_expires(f6i)); DEBUG_NET_WARN_ON_ONCE(!hlist_unhashed(&f6i->gc_link)); call_rcu(&f6i->rcu, fib6_info_destroy_rcu); }