lkml.org 
[lkml]   [2018]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2] net: arcnet: Fix a possible concurrency use-after-free bug in arcnet_reply_tasklet()
From
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Thu, 27 Dec 2018 10:01:42 +0800

> @@ -401,6 +401,7 @@ static void arcnet_reply_tasklet(unsigned long data)
> struct sock_exterr_skb *serr;
> struct sock *sk;
> int ret;
> + unsigned long flags;
>
> local_irq_disable();
> skb = lp->outgoing.skb;
> @@ -426,10 +427,14 @@ static void arcnet_reply_tasklet(unsigned long data)
> serr->ee.ee_data = skb_shinfo(skb)->tskey;
> serr->ee.ee_info = lp->reply_status;
>
> + spin_lock_irqsave(&lp->lock, flags);
> +
> /* finally erasing outgoing skb */
> dev_kfree_skb(lp->outgoing.skb);
> lp->outgoing.skb = NULL;
>
> + spin_unlock_irqrestore(&lp->lock, flags);
> +
> ackskb->dev = lp->dev;
>
> ret = sock_queue_err_skb(sk, ackskb);

This is not the correct fix.

You need to instead replace the existing local_irq_*() calls in the
function with the spinlock stuff.

\
 
 \ /
  Last update: 2018-12-29 06:32    [W:0.026 / U:2.152 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site