lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 28 Apr 2019 16:02:05 -0600 From: David Ahern <dsahern@...il.com> To: Eric Dumazet <edumazet@...gle.com>, "David S . Miller" <davem@...emloft.net> Cc: netdev <netdev@...r.kernel.org>, Eric Dumazet <eric.dumazet@...il.com>, syzbot <syzkaller@...glegroups.com> Subject: Re: [PATCH net] ipv6: fix races in ip6_dst_destroy() On 4/28/19 1:22 PM, Eric Dumazet wrote: > We had many syzbot reports that seem to be caused by use-after-free > of struct fib6_info. > > ip6_dst_destroy(), fib6_drop_pcpu_from() and rt6_remove_exception() > are writers vs rt->from, and use non consistent synchronization among > themselves. > > Switching to xchg() will solve the issues with no possible > lockdep issues. > ... > > Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected") > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Reported-by: syzbot <syzkaller@...glegroups.com> > Cc: David Ahern <dsahern@...il.com> > --- > net/ipv6/ip6_fib.c | 4 +--- > net/ipv6/route.c | 9 ++------- > 2 files changed, 3 insertions(+), 10 deletions(-) > Reviewed-by: David Ahern <dsahern@...il.com> Thanks for the fix, Eric.
Powered by blists - more mailing lists