From: Cong Wang <xiyou.wangcong@gmail.com>
To: Stefano Brivio <sbrivio@redhat.com>
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>,
Linux Kernel Network Developers <netdev@vger.kernel.org>,
Eric Dumazet <eric.dumazet@gmail.com>,
Lorenzo Colitti <lorenzo@google.com>
Subject: Re: Use after free in __dst_destroy_metrics_generic
Date: Fri, 8 Sep 2017 09:12:09 -0700 [thread overview]
Message-ID: <CAM_iQpV--V9ROSd61CWVbcpCHonMUubLeyEKVSvEUTTW3gh5hA@mail.gmail.com> (raw)
In-Reply-To: <20170908025620.47d0ad2e@elisabeth>
On Thu, Sep 7, 2017 at 5:56 PM, Stefano Brivio <sbrivio@redhat.com> wrote:
> On Thu, 07 Sep 2017 18:52:02 -0600
> Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> wrote:
>
>> We are seeing a possible use after free in ip6_dst_destroy.
>>
>> It appears as if memory of the __DST_METRICS_PTR(old) was freed in some
>> path and allocated
>> to ion driver. ion driver has also freed it. Finally the memory is freed
>> by the
>> fib gc and crashes since it is already deallocated.
>>
>> Target is running an ARM64 Android based 4.9 kernel.
>> Issue was seen once on a regression rack (sorry, no reproducer).
>> Any pointers to debug this is highly appreciated.
>>
>> [ 3489.470581] [<ffffff83c0a289c0>] object_err+0x4c/0x5c
>> [ 3489.470586] [<ffffff83c0a2b284>] free_debug_processing+0x2e0/0x398
>> [ 3489.470589] [<ffffff83c0a2b63c>] __slab_free+0x300/0x3e0
>> [ 3489.470593] [<ffffff83c0a2bfc8>] kfree+0x28c/0x290
>> [ 3489.470601] [<ffffff83c16b9580>]
>> __dst_destroy_metrics_generic+0x6c/0x78
>> [ 3489.470609] [<ffffff83c17d3408>] ip6_dst_destroy+0xb0/0xb4
>
> Should be fixed by:
>
> commit ad65a2f05695aced349e308193c6e2a6b1d87112
> Author: Wei Wang <weiwan@google.com>
> Date: Sat Jun 17 10:42:35 2017 -0700
>
> ipv6: call dst_hold_safe() properly
Obviously it should not. One is dst metric, the other is dst.
next prev parent reply other threads:[~2017-09-08 16:12 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-08 0:52 Use after free in __dst_destroy_metrics_generic Subash Abhinov Kasiviswanathan
2017-09-08 0:56 ` Stefano Brivio
2017-09-08 1:33 ` Subash Abhinov Kasiviswanathan
2017-09-08 16:12 ` Cong Wang [this message]
2017-09-08 16:17 ` Stefano Brivio
2017-09-08 2:13 ` David Miller
2017-09-08 3:27 ` Subash Abhinov Kasiviswanathan
2017-09-08 16:10 ` Cong Wang
2017-09-08 17:16 ` Eric Dumazet
2017-09-08 17:19 ` David Miller
2017-09-08 17:28 ` Eric Dumazet
2017-09-08 19:50 ` Subash Abhinov Kasiviswanathan
2017-09-15 21:00 ` Eric Dumazet
2017-09-15 22:38 ` Julian Anastasov
2017-09-15 23:20 ` Subash Abhinov Kasiviswanathan
2017-09-16 12:40 ` Julian Anastasov
2017-09-16 18:21 ` Cong Wang
2017-09-16 18:13 ` Cong Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAM_iQpV--V9ROSd61CWVbcpCHonMUubLeyEKVSvEUTTW3gh5hA@mail.gmail.com \
--to=xiyou.wangcong@gmail.com \
--cc=eric.dumazet@gmail.com \
--cc=lorenzo@google.com \
--cc=netdev@vger.kernel.org \
--cc=sbrivio@redhat.com \
--cc=subashab@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).