Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1622254
| From | Willem de Bruijn <willemdebruijn.kernel@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg |
| Date | 2017-04-12 17:50 +0200 |
| Message-ID | <tvsGR-6f3-7@gated-at.bofh.it> (permalink) |
| References | <tvrKO-5EQ-23@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
===================
> BUG: KASAN: use-after-free in ipv4_datagram_support_cmsg
> net/ipv4/ip_sockglue.c:500 [inline] at addr ffff880059be0128
Thanks for the report. This is accessing skb->dev from within recvmsg() at line
info->ipi_ifindex = skb->dev->ifindex;
Introduced in 829ae9d61165 ("net-timestamp: allow reading recv cmsg on
errqueue with origin tstamp"). At this time the device may indeed have
gone away. I'm having a look at a way to read this in the receive BH
and store the ifindex.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
net/ipv4: use-after-free in ipv4_datagram_support_cmsg Andrey Konovalov <andreyknvl@google.com> - 2017-04-12 16:50 +0200
Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-12 17:50 +0200
Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Cong Wang <xiyou.wangcong@gmail.com> - 2017-04-12 22:10 +0200
Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-12 22:50 +0200
Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-13 00:30 +0200
Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-13 01:30 +0200
csiph-web