Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1590845
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net: use-after-free in neigh_timer_handler/sock_wfree |
| Date | 2017-03-02 06:30 +0100 |
| Message-ID | <tgrtn-612-3@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <tgk8y-ze-17@gated-at.bofh.it> <tgkie-DA-11@gated-at.bofh.it> <tglxE-1Kg-9@gated-at.bofh.it> <tglHk-1Og-13@gated-at.bofh.it> <tglQZ-1Rz-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, Mar 1, 2017 at 3:15 PM, Eric Dumazet <edumazet@google.com> wrote: > On Wed, Mar 1, 2017 at 3:09 PM, Cong Wang <xiyou.wangcong@gmail.com> wrote: > >> >> But I doubt skb_orphan() is the solution here, shouldn't we just >> update sk->sk_wmem_alloc with skb->truesize changes? > > Is it worth it ? Apart from syszkaller I mean... > > We started with something that had a real impact on real workloads. > > 158f323b9868b59967ad96957c4ca388161be321 net: adjust skb->truesize in > pskb_expand_head() > > Note that auditing the stack took me a while. I don't know how sk refcnt could work correctly without making sk_wmem_alloc correctly. We certainly could just call skb_orphan() is we don't need skb->sk any more, probably like the frag case, but for this case, the neigh one, the skb's sitting in neigh->arp_queue are not going to be freed unless in failed case, therefore skb->sk should not be orphaned so early.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: net: use-after-free in neigh_timer_handler/sock_wfree Cong Wang <xiyou.wangcong@gmail.com> - 2017-03-01 22:40 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Cong Wang <xiyou.wangcong@gmail.com> - 2017-03-01 22:50 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Eric Dumazet <edumazet@google.com> - 2017-03-02 00:10 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Cong Wang <xiyou.wangcong@gmail.com> - 2017-03-02 00:20 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Eric Dumazet <edumazet@google.com> - 2017-03-02 00:30 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Cong Wang <xiyou.wangcong@gmail.com> - 2017-03-02 06:30 +0100
Re: net: use-after-free in neigh_timer_handler/sock_wfree Eric Dumazet <edumazet@google.com> - 2017-03-02 06:50 +0100
csiph-web