linux-kernel - Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes oops during teardown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <55867d3a-7668-7a77-ea51-3de76b1b6bda@redhat.com>
Date:	Thu, 11 Aug 2016 16:58:44 +0800
From:	Jason Wang <jasowang@...hat.com>
To:	Cornelia Huck <cornelia.huck@...ibm.com>
Cc:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Christian Borntraeger <borntraeger@...ibm.com>
Subject: Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes
 oops during teardown



On 2016年08月11日 16:13, Cornelia Huck wrote:
> On Thu, 11 Aug 2016 15:49:12 +0800
> Jason Wang <jasowang@...hat.com> wrote:
>
>> This looks like a use-after-free. Could you pls try the following patch
>> to see it if fixes your issue?
>>
>> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
>> index a38c0da..070e329 100644
>> --- a/drivers/net/macvtap.c
>> +++ b/drivers/net/macvtap.c
>> @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
>>           rtnl_unlock();
>>
>>           synchronize_rcu();
>> -       skb_array_cleanup(&q->skb_array);
>>           sock_put(&q->sk);
>>    }
>>
>> @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
>>    static void macvtap_sock_destruct(struct sock *sk)
>>    {
>>           struct macvtap_queue *q = container_of(sk, struct
>> macvtap_queue, sk);
>> -       struct sk_buff *skb;
>>
>> -       while ((skb = skb_array_consume(&q->skb_array)) != NULL)
>> -               kfree_skb(skb);
>> +       skb_array_cleanup(&q->skb_array);
>>    }
>>
>>    static int macvtap_open(struct inode *inode, struct file *file)
> Yes, that change fixes things for me.
>
> Tested-by: Cornelia Huck <cornelia.huck@...ibm.com>
>
> Thanks for the quick reply!
>

Thanks for the testing.

Will send a formal patch shortly.