Re: net/ipv4: use-after-free in ipv4_mtu

From	Eric Dumazet <eric.dumazet@gmail.com>
Newsgroups	linux.kernel
Subject	Re: net/ipv4: use-after-free in ipv4_mtu
Date	2017-04-06 12:50 +0200
Message-ID	<ttd9g-7m3-5@gated-at.bofh.it> (permalink)
References	<tsy66-6cs-25@gated-at.bofh.it> <tsBQm-hL-27@gated-at.bofh.it> <tsHM5-4f4-7@gated-at.bofh.it> <tsJbb-54X-1@gated-at.bofh.it> <tt1KO-8w3-21@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, 2017-04-05 at 15:33 -0700, Cong Wang wrote:

> Good find! I missed the refcnt in rt_set_nexthop() before that commit.
> 
> We need to revert that commit to restore the refcnt for fib_info.

Well, there are other spots , in decnet and IPv6.

This is why my original mail stated the problem was in the calls to :

dst_init_metrics(&rt->dst, fi->fib_metrics, true);

Lets do not think in "reverting" spirit, but adding the missing bits.

The problem here is that the metrics should not be freed until last user
is gone.

So maybe a refcount should be added to metrics, and we do not have to
add a fib pointer again in all dsts.

Thanks.

Thread

net/ipv4: use-after-free in ipv4_mtu Andrey Konovalov <andreyknvl@google.com> - 2017-04-04 17:00 +0200
  Re: net/ipv4: use-after-free in ipv4_mtu Eric Dumazet <edumazet@google.com> - 2017-04-04 21:00 +0200
    Re: net/ipv4: use-after-free in ipv4_mtu Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-05 03:20 +0200
      Re: net/ipv4: use-after-free in ipv4_mtu Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-05 04:50 +0200
        Re: net/ipv4: use-after-free in ipv4_mtu Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> - 2017-04-05 21:00 +0200
        Re: net/ipv4: use-after-free in ipv4_mtu Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-06 00:40 +0200
          Re: net/ipv4: use-after-free in ipv4_mtu Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-06 12:50 +0200
            Re: net/ipv4: use-after-free in ipv4_mtu Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-07 19:20 +0200

csiph-web