Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1578645
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net/packet: use-after-free in packet_rcv_fanout |
| Date | 2017-02-10 19:00 +0100 |
| Message-ID | <t9nEd-6Co-9@gated-at.bofh.it> (permalink) |
| References | <t8WNH-6CT-5@gated-at.bofh.it> <t98c9-5f1-1@gated-at.bofh.it> <t99UB-6os-3@gated-at.bofh.it> <t9a4i-6rR-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Feb 9, 2017 at 7:23 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > On Thu, 2017-02-09 at 19:19 -0800, Eric Dumazet wrote: > >> More likely the bug is in fanout_add(), with a buggy sequence in error >> case, and not correct locking. >> >> kfree(po->rollover); >> po->rollover = NULL; >> >> Two cpus entering fanout_add() (using the same af_packet socket, >> syzkaller courtesy...) might both see po->fanout being NULL. >> >> Then they grab the mutex. Too late... > > Patch could be : > For me, clearly the data structure that use-after-free'd is struct sock rather than struct packet_rollover.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
net/packet: use-after-free in packet_rcv_fanout Dmitry Vyukov <dvyukov@google.com> - 2017-02-09 14:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-09 16:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <edumazet@google.com> - 2017-02-09 16:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Cong Wang <xiyou.wangcong@gmail.com> - 2017-02-10 02:30 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <eric.dumazet@gmail.com> - 2017-02-10 04:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <eric.dumazet@gmail.com> - 2017-02-10 04:30 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Cong Wang <xiyou.wangcong@gmail.com> - 2017-02-10 19:00 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <eric.dumazet@gmail.com> - 2017-02-10 19:10 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Cong Wang <xiyou.wangcong@gmail.com> - 2017-02-10 19:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <eric.dumazet@gmail.com> - 2017-02-10 19:30 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <eric.dumazet@gmail.com> - 2017-02-10 19:20 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Cong Wang <xiyou.wangcong@gmail.com> - 2017-02-10 19:50 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-10 04:40 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Eric Dumazet <edumazet@google.com> - 2017-02-10 05:30 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Cong Wang <xiyou.wangcong@gmail.com> - 2017-02-10 19:10 +0100
Re: net/packet: use-after-free in packet_rcv_fanout Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-10 20:20 +0100
csiph-web