Re: memory leak in do_ipv6_setsockopt

From	Daniel Borkmann <daniel@iogearbox.net>
Newsgroups	linux.kernel
Subject	Re: memory leak in do_ipv6_setsockopt
Date	2015-12-01 15:50 +0100
Message-ID	<qAUpH-2rO-3@gated-at.bofh.it> (permalink)
References	(1 earlier) <qATjY-1Oq-27@gated-at.bofh.it> <qATN0-2eD-11@gated-at.bofh.it> <qATWG-2hS-7@gated-at.bofh.it> <qAU6m-2l1-23@gated-at.bofh.it> <qAUg2-2ob-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 12/01/2015 03:38 PM, Eric Dumazet wrote:
> On Tue, 2015-12-01 at 15:24 +0100, Daniel Borkmann wrote:
>> On 12/01/2015 03:16 PM, Eric Dumazet wrote:
>>> On Tue, 2015-12-01 at 15:07 +0100, Daniel Borkmann wrote:
>>>
>>>> Yeah, we miss inet6_destroy_sock() in SCTP. :-(
>>>>
>>>> Looks good to me.
>>>
>>> OK, I will send a formal (and tested ;) ) patch.
>>
>> I was shortly wondering whether there could be a use-after-free by
>> doing this after sctp_destroy_sock() due to the sctp_endpoint_destroy()
>> that would eventually drop a ref on the socket, but the endpoint holds
>> a separate ref, so we should be good.
>
> More generically ->destroy() caller must keep a reference on the socket.
>
> inet_csk_destroy_sock() for example uses sk after
>
> sk->sk_prot->destroy(sk);

Right, and later on, we might call into ->sk_destruct() when there are no
more refs (in SCTP case: sctp_destruct_sock()).

Thanks,
Daniel
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

memory leak in do_ipv6_setsockopt Dmitry Vyukov <dvyukov@google.com> - 2015-12-01 13:30 +0100
  Re: memory leak in do_ipv6_setsockopt Eric Dumazet <eric.dumazet@gmail.com> - 2015-12-01 14:40 +0100
    Re: memory leak in do_ipv6_setsockopt Daniel Borkmann <daniel@iogearbox.net> - 2015-12-01 15:10 +0100
      Re: memory leak in do_ipv6_setsockopt Eric Dumazet <eric.dumazet@gmail.com> - 2015-12-01 15:20 +0100
        Re: memory leak in do_ipv6_setsockopt Daniel Borkmann <daniel@iogearbox.net> - 2015-12-01 15:30 +0100
          Re: memory leak in do_ipv6_setsockopt Eric Dumazet <eric.dumazet@gmail.com> - 2015-12-01 15:40 +0100
            Re: memory leak in do_ipv6_setsockopt Daniel Borkmann <daniel@iogearbox.net> - 2015-12-01 15:50 +0100
            [PATCH net] ipv6: sctp: implement sctp_v6_destroy_sock() Eric Dumazet <eric.dumazet@gmail.com> - 2015-12-01 16:30 +0100
              Re: [PATCH net] ipv6: sctp: implement sctp_v6_destroy_sock() Daniel Borkmann <daniel@iogearbox.net> - 2015-12-01 17:00 +0100
              Re: [PATCH net] ipv6: sctp: implement sctp_v6_destroy_sock() David Miller <davem@davemloft.net> - 2015-12-03 18:10 +0100

csiph-web