netdev - Re: crash in __kfree_skb on v3.18-rc5 with CONFIG_DEBUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1416590283.24312.8@mail.thefacebook.com>
Date:	Fri, 21 Nov 2014 12:18:03 -0500
From:	Chris Mason <clm@...com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	<netdev@...r.kernel.org>
Subject: Re: crash in __kfree_skb on v3.18-rc5 with CONFIG_DEBUG_PAGEALLOC

On Fri, Nov 21, 2014 at 11:56 AM, Eric Dumazet <eric.dumazet@...il.com> 
wrote:
> On Fri, 2014-11-21 at 11:47 -0500, Chris Mason wrote:
> 
>>  Once my current run is done, I can revert this and try a loop.  But 
>> I
>>  don't see how this commit causes a use-after-free on the skb itself?
> 
> Well, it is so obvious, you really want to make me miserable ;)
> 
> I am testing the revert and send it asap.

Grin, no I just don't know what fclones really are ;)  So dropping the 
ref by one on the clone opens up the skb to be freed and another CPU 
races in and frees skb before we can do the assignment lower down.

I've added your revert here and I'll restart the test.  It takes a few 
hours to get to the point where I've fallen over so far today, but I'll 
just leave it in a loop all day long.

Thanks!

-chris

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html