Messages in this thread | | | Date | Mon, 27 Mar 2017 21:07:24 -0700 (PDT) | Subject | Re: [PATCH] net: ipconfig: fix ic_close_devs() use-after-free | From | David Miller <> |
| |
From: Mark Rutland <mark.rutland@arm.com> Date: Mon, 27 Mar 2017 18:00:14 +0100
> Our chosen ic_dev may be anywhere in our list of ic_devs, and we may > free it before attempting to close others. When we compare d->dev and > ic_dev->dev, we're potentially dereferencing memory returned to the > allocator. This causes KASAN to scream for each subsequent ic_dev we > check. > > As there's a 1-1 mapping between ic_devs and netdevs, we can instead > compare d and ic_dev directly, which implicitly handles the !ic_dev > case, and avoids the use-after-free. The ic_dev pointer may be stale, > but we will not dereference it. > > Original splat: ... > Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Applied, thanks.
| |