Re: use after free bug in socket code

[Oliver Hartkopp <oliver@hartkopp.net>]

David Miller wrote:
> From: Lothar Waßmann <LW@KARO-electronics.de>
> Date: Thu, 2 Jul 2009 13:26:30 +0200
> 
>> Hi,
>>
>> while developing a canbus driver (with kernel 2.6.30-rc4) I
>> encountered a use-after-free bug that led to the following crash (due
>> to CONFIG_DEBUG_SLAB being enabled):
>  ...
>> With the following patch I could alleviate the problem and did not
>> find any negative side effects, but I'm not sure, whether this is the
>> Right Thing(TM), since I'm not too familiar with the networking code:
>  ...
>> Any comments on this?
> 
> A patch like this shouldn't be needed.
> 
> Can one of the CAN folks look into this?

Hi Dave,

i did - but i had no concerns that Lothars remark was an appropriate request.

I'm not the socket layer expert but IMO this looks like something to be fixed
in standard networking code.

The only thing we do in out private sk->sk_destruct function is:

   skb_queue_purge(&sk->sk_receive_queue);

As Urs is currently out of office, i added his private mail address ...

Regards,
Oliver