From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net V2] tun: fix use after free for ptr_ring Date: Sun, 13 May 2018 20:18:51 -0400 (EDT) Message-ID: <20180513.201851.1296027654181841669.davem@davemloft.net> References: <1526006965-9124-1-git-send-email-jasowang@redhat.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, xiyou.wangcong@gmail.com, eric.dumazet@gmail.com, mst@redhat.com To: jasowang@redhat.com Return-path: In-Reply-To: <1526006965-9124-1-git-send-email-jasowang@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org From: Jason Wang Date: Fri, 11 May 2018 10:49:25 +0800 > We used to initialize ptr_ring during TUNSETIFF, this is because its > size depends on the tx_queue_len of netdevice. And we try to clean it > up when socket were detached from netdevice. A race were spotted when > trying to do uninit during a read which will lead a use after free for > pointer ring. Solving this by always initialize a zero size ptr_ring > in open() and do resizing during TUNSETIFF, and then we can safely do > cleanup during close(). With this, there's no need for the workaround > that was introduced by commit 4df0bfc79904 ("tun: fix a memory leak > for tfile->tx_array"). > > Reported-by: syzbot+e8b902c3c3fadf0a9dba@syzkaller.appspotmail.com > Cc: Eric Dumazet > Cc: Cong Wang > Cc: Michael S. Tsirkin > Fixes: 1576d9860599 ("tun: switch to use skb array for tx") > Signed-off-by: Jason Wang Jason, please address Cong Wang's concerns. Thank you.