* [PATCH net] macvtap: fix use after free for skb_array during release
@ 2016-08-11 10:15 Jason Wang
2016-08-11 16:56 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jason Wang @ 2016-08-11 10:15 UTC (permalink / raw)
To: netdev, linux-kernel, davem; +Cc: borntraeger, cornelia.huck, mst, Jason Wang
We've clean skb_array in macvtap_put_queue() but still try to pop from
it during macvtap_sock_destruct(). Fix this use after free by moving
the skb array cleanup to macvtap_sock_destruct() instead.
Fixes: 362899b8725b ("macvtap: switch to use skb array")
Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
drivers/net/macvtap.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a38c0da..070e329 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
rtnl_unlock();
synchronize_rcu();
- skb_array_cleanup(&q->skb_array);
sock_put(&q->sk);
}
@@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
static void macvtap_sock_destruct(struct sock *sk)
{
struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk);
- struct sk_buff *skb;
- while ((skb = skb_array_consume(&q->skb_array)) != NULL)
- kfree_skb(skb);
+ skb_array_cleanup(&q->skb_array);
}
static int macvtap_open(struct inode *inode, struct file *file)
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] macvtap: fix use after free for skb_array during release
2016-08-11 10:15 [PATCH net] macvtap: fix use after free for skb_array during release Jason Wang
@ 2016-08-11 16:56 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2016-08-11 16:56 UTC (permalink / raw)
To: jasowang; +Cc: netdev, linux-kernel, borntraeger, cornelia.huck, mst
From: Jason Wang <jasowang@redhat.com>
Date: Thu, 11 Aug 2016 18:15:56 +0800
> We've clean skb_array in macvtap_put_queue() but still try to pop from
> it during macvtap_sock_destruct(). Fix this use after free by moving
> the skb array cleanup to macvtap_sock_destruct() instead.
>
> Fixes: 362899b8725b ("macvtap: switch to use skb array")
> Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Applied, thanks for fixing this so quickly Jason.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-08-11 16:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-11 10:15 [PATCH net] macvtap: fix use after free for skb_array during release Jason Wang
2016-08-11 16:56 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).