Re: [PATCH] ipv4: fib: avoid NULL dereference
From: David Ahern
Date: Fri Jul 06 2018 - 10:48:47 EST
On 7/6/18 8:28 AM, Mark Rutland wrote:
> diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
> index 5bc0c89e81e4..8d98c8162554 100644
> --- a/net/ipv4/fib_trie.c
> +++ b/net/ipv4/fib_trie.c
> @@ -497,11 +497,11 @@ static void tnode_free(struct key_vector *tn)
> struct callback_head *head = &tn_info(tn)->rcu;
>
> while (head) {
> + tn = container_of(head, struct tnode, rcu)->kv;
> +
> head = head->next;
> tnode_free_size += TNODE_SIZE(1ul << tn->bits);
> node_free(tn);
you are changing tn before the above 2 calls are made on the tn passed in
> -
> - tn = container_of(head, struct tnode, rcu)->kv;
> }
>
> if (tnode_free_size >= PAGE_SIZE * sync_pages) {
>