Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932779AbbHYSZi (ORCPT ); Tue, 25 Aug 2015 14:25:38 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:35116 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755246AbbHYSZg (ORCPT ); Tue, 25 Aug 2015 14:25:36 -0400 From: Sasha Levin To: davem@davemloft.net Cc: jbenc@redhat.com, roopa@cumulusnetworks.com, tgraf@suug.ch, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH] route: put lwstate before freeing dst to avoid use after free Date: Tue, 25 Aug 2015 14:25:14 -0400 Message-Id: <1440527114-12746-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 2.1.4 X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1011 Lines: 36 Commit 61adedf3 ("route: move lwtunnel state to dst_entry") is trying to release lwstate after getting rid of dst, which causes a use-after-free trying to access dst->lwstate. Fixes: 61adedf3 ("route: move lwtunnel state to dst_entry") Signed-off-by: Sasha Levin --- net/core/dst.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/dst.c b/net/core/dst.c index 50dcdbb..477035e 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -262,11 +262,12 @@ again: if (dst->dev) dev_put(dst->dev); + lwtstate_put(dst->lwtstate); + if (dst->flags & DST_METADATA) kfree(dst); else kmem_cache_free(dst->ops->kmem_cachep, dst); - lwtstate_put(dst->lwtstate); dst = child; if (dst) { -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/