Re: [PATCH net] ipv6: fix races in ip6_dst_destroy()

[Martin Lau]

On Sun, Apr 28, 2019 at 12:22:25PM -0700, Eric Dumazet wrote:
> We had many syzbot reports that seem to be caused by use-after-free
> of struct fib6_info.
> 
> ip6_dst_destroy(), fib6_drop_pcpu_from() and rt6_remove_exception()
> are writers vs rt->from, and use non consistent synchronization among
> themselves.
> 
> Switching to xchg() will solve the issues with no possible
> lockdep issues.
Acked-by: Martin KaFai Lau <ka...@fb.com>