Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
From: Dan Carpenter <hidden>
Date: 2022-06-14 14:47:20
Also in:
lkml
On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
quoted hunk ↗ jump to hunk
This looks like route4_destroy is deleting the 'fold' which has been freed by tcf_queue_work in route4_change. It means 'fold' is still in the table. I have tested this patch on syzbot and it works well, but I am not sure whether it will introduce other issues...diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index a35ab8c27866..758c21f9d628 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c@@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, rcu_assign_pointer(f->next, f1); rcu_assign_pointer(*fp, f); - if (fold && fold->handle && f->handle != fold->handle) { + if (fold && f->handle != fold->handle) {
^^^^^^^^^^^^ There is still a dereference here so your patch doesn't make sense. :/ regards, dan carpenter
th = to_hash(fold->handle); h = from_hash(fold->handle >> 16); b = rtnl_dereference(head->table[th]); -- You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0c0468ae-5fe3-a71f-c987-18475756caca%40huawei.com.