Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1654735

Re: net/ipv4: use-after-free in add_grec

Show all headers | View raw

On Wed, 2017-05-31 at 16:55 -0700, Eric Dumazet wrote:

> The issue here is the timer firing while ip_mc_clear_src() has been
> already called.
> 
> My patch should fix the problem.
> 
> Or another one using del_timer_sync() instead of del_timer() in
> igmp_stop_timer(), but such a change would be more invasive,
> since the del_timer_sync() would need to happen while im->lock
> spinlock is not held.

BTW, I guess that Andrey could try to add a delay to trigger the bug
more often.

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44fd86de2823dd17de16276a8ec01b190e69b8b4..84fff17daab0832c470a613b29b2aaade07cec0a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -798,7 +798,7 @@ static void igmp_timer_expire(unsigned long data)
 	}
 	im->reporter = 1;
 	spin_unlock(&im->lock);
-
+	udelay(10000);
 	if (IGMP_V1_SEEN(in_dev))
 		igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
 	else if (IGMP_V2_SEEN(in_dev))

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net/ipv4: use-after-free in add_grec Andrey Konovalov <andreyknvl@google.com> - 2017-05-31 11:50 +0200
  Re: net/ipv4: use-after-free in add_grec Eric Dumazet <eric.dumazet@gmail.com> - 2017-05-31 18:20 +0200
    Re: net/ipv4: use-after-free in add_grec Eric Dumazet <edumazet@google.com> - 2017-06-01 02:00 +0200
      Re: net/ipv4: use-after-free in add_grec Eric Dumazet <eric.dumazet@gmail.com> - 2017-06-01 02:20 +0200
        Re: net/ipv4: use-after-free in add_grec Andrey Konovalov <andreyknvl@google.com> - 2017-06-01 14:10 +0200
    Re: net/ipv4: use-after-free in add_grec Cong Wang <xiyou.wangcong@gmail.com> - 2017-06-01 02:00 +0200

csiph-web