Re: [PATCH] net: dst: Force 4-byte alignment of dst_metrics

From: David Miller
Date: Sat Dec 21 2019 - 00:54:26 EST


From: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
Date: Fri, 20 Dec 2019 14:31:40 +0100

> When storing a pointer to a dst_metrics structure in dst_entry._metrics,
> two flags are added in the least significant bits of the pointer value.
> Hence this assumes all pointers to dst_metrics structures have at least
> 4-byte alignment.
>
> However, on m68k, the minimum alignment of 32-bit values is 2 bytes, not
> 4 bytes. Hence in some kernel builds, dst_default_metrics may be only
> 2-byte aligned, leading to obscure boot warnings like:
>
> WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x44/0x9a
> refcount_t: underflow; use-after-free.
> Modules linked in:
> CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G W 5.5.0-rc2-atari-01448-g114a1a1038af891d-dirty #261
> Stack from 10835e6c:
> 10835e6c 0038134f 00023fa6 00394b0f 0000001c 00000009 00321560 00023fea
> 00394b0f 0000001c 001a70f8 00000009 00000000 10835eb4 00000001 00000000
> 04208040 0000000a 00394b4a 10835ed4 00043aa8 001a70f8 00394b0f 0000001c
> 00000009 00394b4a 0026aba8 003215a4 00000003 00000000 0026d5a8 00000001
> 003215a4 003a4361 003238d6 000001f0 00000000 003215a4 10aa3b00 00025e84
> 003ddb00 10834000 002416a8 10aa3b00 00000000 00000080 000aa038 0004854a
> Call Trace: [<00023fa6>] __warn+0xb2/0xb4
> [<00023fea>] warn_slowpath_fmt+0x42/0x64
> [<001a70f8>] refcount_warn_saturate+0x44/0x9a
> [<00043aa8>] printk+0x0/0x18
> [<001a70f8>] refcount_warn_saturate+0x44/0x9a
> [<0026aba8>] refcount_sub_and_test.constprop.73+0x38/0x3e
> [<0026d5a8>] ipv4_dst_destroy+0x5e/0x7e
> [<00025e84>] __local_bh_enable_ip+0x0/0x8e
> [<002416a8>] dst_destroy+0x40/0xae
>
> Fix this by forcing 4-byte alignment of all dst_metrics structures.
>
> Fixes: e5fd387ad5b30ca3 ("ipv6: do not overwrite inetpeer metrics prematurely")
> Signed-off-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>

Applied.