Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1694253
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: af_packet: use after free in prb_retire_rx_blk_timer_expired |
| Date | 2017-07-23 08:00 +0200 |
| Message-ID | <u6i5Q-3vn-3@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <tuNaF-50X-1@gated-at.bofh.it> <tvdot-5c0-3@gated-at.bofh.it> <u5Zwd-Ca-7@gated-at.bofh.it> <u67WN-5Nu-3@gated-at.bofh.it> <u6g41-2gT-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Sat, Jul 22, 2017 at 8:40 PM, Ding Tianhong <dingtianhong@huawei.com> wrote:
> Hi, Cong:
>
> Thanks for your quirk solution, but I still has some doubts about it,
> it looks like fix the problem in the packet_setsockopt->packet_set_ring processing,
> but when in packet_release processing, it may could not release the
> real pg_vec for the TPACKET_V3 ring, and then cause the mem leak,
> maybe I miss something here, nice to hear from your feedback. :)
Yes you miss that packet_release() has memset()'s so we won't hit
that path. :)
However, I missed the swap() in this messy function, actually I
believe the bug is that we modify tpacket_kbdq_core inside rx_ring
in non-closing case without actually stopping its timer. I feel
more confident with the following patch:
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 008bb34ee324..267b181fef15 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4263,6 +4263,7 @@ static int packet_set_ring(struct sock *sk,
union tpacket_req_u *req_u,
case TPACKET_V3:
/* Block transmit is not supported yet */
if (!tx_ring) {
+ prb_shutdown_retire_blk_timer(po, rb_queue);
init_prb_bdqc(po, rb, pg_vec, req_u);
} else {
struct tpacket_req3 *req3 = &req_u->req3;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
RE: af_packet: use after free in prb_retire_rx_blk_timer_expired "liujian (CE)" <liujian56@huawei.com> - 2017-07-22 12:10 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Cong Wang <xiyou.wangcong@gmail.com> - 2017-07-22 21:10 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Ding Tianhong <dingtianhong@huawei.com> - 2017-07-23 05:50 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Cong Wang <xiyou.wangcong@gmail.com> - 2017-07-23 08:00 +0200
RE: af_packet: use after free in prb_retire_rx_blk_timer_expired "liujian (CE)" <liujian56@huawei.com> - 2017-07-23 10:30 +0200
RE: af_packet: use after free in prb_retire_rx_blk_timer_expired "liujian (CE)" <liujian56@huawei.com> - 2017-07-23 12:00 +0200
RE: af_packet: use after free in prb_retire_rx_blk_timer_expired "liujian (CE)" <liujian56@huawei.com> - 2017-07-23 15:10 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Cong Wang <xiyou.wangcong@gmail.com> - 2017-07-23 19:10 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Ding Tianhong <dingtianhong@huawei.com> - 2017-07-24 03:20 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Ding Tianhong <dingtianhong@huawei.com> - 2017-07-24 03:40 +0200
RE: af_packet: use after free in prb_retire_rx_blk_timer_expired "liujian (CE)" <liujian56@huawei.com> - 2017-07-24 12:50 +0200
csiph-web