From: Nicolas Dichtel Date: Fri, 8 Nov 2013 10:13:55 +0000 (+0100) Subject: sctp: unbalanced rcu lock in ip_queue_xmit() X-Git-Tag: v2.6.32.62~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8663707a797e6a473c32cf08eb7597543bbdae79;p=thirdparty%2Fkernel%2Fstable.git sctp: unbalanced rcu lock in ip_queue_xmit() The bug was introduced in 2.6.32.61 by commit b8710128e201 ("inet: add RCU protection to inet->opt") (it's a backport of upstream commit f6d8bd051c39). In SCTP case, packet is already routed, hence we jump to the label 'packet_routed', but without rcu_read_lock(). After this label, rcu_read_unlock() is called unconditionally. Spotted-by: Guo Fengtian Signed-off-by: Nicolas Dichtel Signed-off-by: Willy Tarreau --- diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 7dde039374e4c..2cd69e3497ad6 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -320,13 +320,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok) /* Skip all of this if the packet is already routed, * f.e. by something like SCTP. */ + rcu_read_lock(); rt = skb_rtable(skb); if (rt != NULL) goto packet_routed; /* Make sure we can route this packet. */ rt = (struct rtable *)__sk_dst_check(sk, 0); - rcu_read_lock(); inet_opt = rcu_dereference(inet->inet_opt); if (rt == NULL) { __be32 daddr;