Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1586495 > unrolled thread
| Started by | David Miller <davem@davemloft.net> |
|---|---|
| First post | 2017-02-22 22:20 +0100 |
| Last post | 2017-02-22 22:20 +0100 |
| Articles | 1 — 1 participant |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH v2] net/dccp: fix use after free in tw_timer_handler() David Miller <davem@davemloft.net> - 2017-02-22 22:20 +0100
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2017-02-22 22:20 +0100 |
| Subject | Re: [PATCH v2] net/dccp: fix use after free in tw_timer_handler() |
| Message-ID | <tdMun-7Lo-31@gated-at.bofh.it> |
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Wed, 22 Feb 2017 12:35:27 +0300
> DCCP doesn't purge timewait sockets on network namespace shutdown.
> So, after net namespace destroyed we could still have an active timer
> which will trigger use after free in tw_timer_handler():
...
> Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge
> timewait sockets on net namespace destruction and prevent above issue.
>
> Fixes: f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH")
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Applied and queued up for -sable, thanks.
Back to top | Article view | linux.kernel
csiph-web