Re: use-after-free in sixpack_close

From	One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Newsgroups	linux.kernel
Subject	Re: use-after-free in sixpack_close
Date	2015-12-18 23:10 +0100
Message-ID	<qHbnP-32K-9@gated-at.bofh.it> (permalink)
References	<qGFei-7iO-13@gated-at.bofh.it> <qGNYe-4LR-19@gated-at.bofh.it> <qGQt3-6k7-5@gated-at.bofh.it> <qHarM-2rz-43@gated-at.bofh.it>
Organization	Intel Corporation

Show all headers | View raw

> > Also you are at the point the tty is closing so the net device may be
> > active. Don't you need to netif_stop_queue() or defer the buffer
> > kfrees until after the network device is unregistered so you don't pee
> > into free memory if you have a transmit occurring ?
> 
> I'm pretty sure that's what the semaphore down above this sequence is
> accomplishing.  But if we do need the netif_stop_queue() let's do that
> as a separate patch.

Follow the code path for sp_xmit(). If sp_xmit is called it digs out sp
from the ndetdev, locks sp->lock and stops the queue then calls sp_encaps
which touches sp->xbuff.

So if one thread of execution hits sp_xmit and another closes the ldisc
at just the wrong moment then we have no protection.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

use-after-free in sixpack_close Dmitry Vyukov <dvyukov@google.com> - 2015-12-17 12:20 +0100
  Re: use-after-free in sixpack_close One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2015-12-17 12:50 +0100
    Re: use-after-free in sixpack_close David Miller <davem@davemloft.net> - 2015-12-17 22:10 +0100
      Re: use-after-free in sixpack_close Ralf Baechle DL5RB <ralf@linux-mips.org> - 2015-12-17 22:40 +0100
      Re: use-after-free in sixpack_close One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2015-12-18 00:50 +0100
        Re: use-after-free in sixpack_close David Miller <davem@davemloft.net> - 2015-12-18 22:10 +0100
          Re: use-after-free in sixpack_close One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2015-12-18 23:10 +0100

csiph-web