netdev - Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes oops during teardown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160811101320.20f03b17.cornelia.huck@de.ibm.com>
Date:	Thu, 11 Aug 2016 10:13:20 +0200
From:	Cornelia Huck <cornelia.huck@...ibm.com>
To:	Jason Wang <jasowang@...hat.com>
Cc:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Christian Borntraeger <borntraeger@...ibm.com>
Subject: Re: [REGRESSION] 362899b ("macvtap: switch to use skb array")
 causes oops during teardown

On Thu, 11 Aug 2016 15:49:12 +0800
Jason Wang <jasowang@...hat.com> wrote:

> This looks like a use-after-free. Could you pls try the following patch 
> to see it if fixes your issue?
> 
> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
> index a38c0da..070e329 100644
> --- a/drivers/net/macvtap.c
> +++ b/drivers/net/macvtap.c
> @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
>          rtnl_unlock();
> 
>          synchronize_rcu();
> -       skb_array_cleanup(&q->skb_array);
>          sock_put(&q->sk);
>   }
> 
> @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
>   static void macvtap_sock_destruct(struct sock *sk)
>   {
>          struct macvtap_queue *q = container_of(sk, struct 
> macvtap_queue, sk);
> -       struct sk_buff *skb;
> 
> -       while ((skb = skb_array_consume(&q->skb_array)) != NULL)
> -               kfree_skb(skb);
> +       skb_array_cleanup(&q->skb_array);
>   }
> 
>   static int macvtap_open(struct inode *inode, struct file *file)

Yes, that change fixes things for me.

Tested-by: Cornelia Huck <cornelia.huck@...ibm.com>

Thanks for the quick reply!