Patch "ipv4: fix NULL dereference in free_fib_info_rcu()" has been added to the 4.12-stable tree

This is a note to let you know that I've just added the patch titled

ipv4: fix NULL dereference in free_fib_info_rcu()

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv4-fix-null-dereference-in-free_fib_info_rcu.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Tue, 15 Aug 2017 05:26:17 -0700
Subject: ipv4: fix NULL dereference in free_fib_info_rcu()

From: Eric Dumazet <[email protected]>

[ Upstream commit 187e5b3ac84d3421d2de3aca949b2791fbcad554 ]

If fi->fib_metrics could not be allocated in fib_create_info() we attempt to dereference a NULL pointer in free_fib_info_rcu() :

    m = fi->fib_metrics;
    if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
            kfree(m);

Before my recent patch, we used to call kfree(NULL) and nothing wrong happened.

Instead of using RCU to defer freeing while we are under memory stress, it seems better to take immediate action.

This was reported by syzkaller team.

---
 net/ipv4/fib_semantics.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -1033,15 +1033,17 @@ struct fib_info *fib_create_info(struct
 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
 	if (!fi)
 		goto failure;
-	fib_info_cnt++;
 	if (cfg->fc_mx) {
 		fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-		if (!fi->fib_metrics)
-			goto failure;
+		if (unlikely(!fi->fib_metrics)) {
+			kfree(fi);
+			return ERR_PTR(err);
+		}
 		atomic_set(&fi->fib_metrics->refcnt, 1);
-	} else
+	} else {
 		fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
-
+	}
+	fib_info_cnt++;
 	fi->fib_net = net;
 	fi->fib_protocol = cfg->fc_protocol;
 	fi->fib_scope = cfg->fc_scope;

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/ipv4-fix-null-dereference-in-free_fib_info_rcu.patch queue-4.12/tcp-when-rearming-rto-if-rto-time-is-in-past-then-fire-rto-asap.patch queue-4.12/ipv4-better-ip_max_mtu-enforcement.patch queue-4.12/dccp-defer-ccid_hc_tx_delete-at-dismantle-time.patch queue-4.12/tun-handle-register_netdevice-failures-properly.patch queue-4.12/tipc-fix-use-after-free.patch queue-4.12/af_key-do-not-use-gfp_kernel-in-atomic-contexts.patch queue-4.12/ipv6-repair-fib6-tree-in-failure-case.patch queue-4.12/dccp-purge-write-queue-in-dccp_destroy_sock.patch queue-4.12/ipv6-reset-fn-rr_ptr-when-replacing-route.patch queue-4.12/ptr_ring-use-kmalloc_array.patch queue-4.12/net_sched-sfq-update-hierarchical-backlog-when-drop-packet.patch