lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190430.234014.837178465736820152.davem@davemloft.net> Date: Tue, 30 Apr 2019 23:40:14 -0400 (EDT) From: David Miller <davem@...emloft.net> To: edumazet@...gle.com Cc: netdev@...r.kernel.org, eric.dumazet@...il.com, syzkaller@...glegroups.com, dsahern@...il.com Subject: Re: [PATCH net] ipv6: fix races in ip6_dst_destroy() From: Eric Dumazet <edumazet@...gle.com> Date: Sun, 28 Apr 2019 12:22:25 -0700 > We had many syzbot reports that seem to be caused by use-after-free > of struct fib6_info. > > ip6_dst_destroy(), fib6_drop_pcpu_from() and rt6_remove_exception() > are writers vs rt->from, and use non consistent synchronization among > themselves. > > Switching to xchg() will solve the issues with no possible > lockdep issues. ... > Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected") > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Reported-by: syzbot <syzkaller@...glegroups.com> > Cc: David Ahern <dsahern@...il.com> Applied and queued up for -stable, thanks Eric.
Powered by blists - more mailing lists