Messages in this thread | | | Date | Fri, 28 Dec 2018 21:31:03 -0800 (PST) | Subject | Re: [PATCH v2] net: arcnet: Fix a possible concurrency use-after-free bug in arcnet_reply_tasklet() | From | David Miller <> |
| |
From: Jia-Ju Bai <baijiaju1990@gmail.com> Date: Thu, 27 Dec 2018 10:01:42 +0800
> @@ -401,6 +401,7 @@ static void arcnet_reply_tasklet(unsigned long data) > struct sock_exterr_skb *serr; > struct sock *sk; > int ret; > + unsigned long flags; > > local_irq_disable(); > skb = lp->outgoing.skb; > @@ -426,10 +427,14 @@ static void arcnet_reply_tasklet(unsigned long data) > serr->ee.ee_data = skb_shinfo(skb)->tskey; > serr->ee.ee_info = lp->reply_status; > > + spin_lock_irqsave(&lp->lock, flags); > + > /* finally erasing outgoing skb */ > dev_kfree_skb(lp->outgoing.skb); > lp->outgoing.skb = NULL; > > + spin_unlock_irqrestore(&lp->lock, flags); > + > ackskb->dev = lp->dev; > > ret = sock_queue_err_skb(sk, ackskb);
This is not the correct fix.
You need to instead replace the existing local_irq_*() calls in the function with the spinlock stuff.
| |