Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1622254

Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg

From Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Newsgroups linux.kernel
Subject Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg
Date 2017-04-12 17:50 +0200
Message-ID <tvsGR-6f3-7@gated-at.bofh.it> (permalink)
References <tvrKO-5EQ-23@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


===================
> BUG: KASAN: use-after-free in ipv4_datagram_support_cmsg
> net/ipv4/ip_sockglue.c:500 [inline] at addr ffff880059be0128

Thanks for the report. This is accessing skb->dev from within recvmsg() at line

        info->ipi_ifindex = skb->dev->ifindex;

Introduced in 829ae9d61165 ("net-timestamp: allow reading recv cmsg on
errqueue with origin tstamp"). At this time the device may indeed have
gone away. I'm having a look at a way to read this in the receive BH
and store the ifindex.

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

net/ipv4: use-after-free in ipv4_datagram_support_cmsg Andrey Konovalov <andreyknvl@google.com> - 2017-04-12 16:50 +0200
  Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-12 17:50 +0200
    Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-12 22:10 +0200
      Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-12 22:50 +0200
        Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-13 00:30 +0200
          Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-13 01:30 +0200

csiph-web