Messages in this thread | | | Subject | Re: memory leak in do_ipv6_setsockopt | From | Eric Dumazet <> | Date | Tue, 01 Dec 2015 06:38:43 -0800 |
| |
On Tue, 2015-12-01 at 15:24 +0100, Daniel Borkmann wrote: > On 12/01/2015 03:16 PM, Eric Dumazet wrote: > > On Tue, 2015-12-01 at 15:07 +0100, Daniel Borkmann wrote: > > > >> Yeah, we miss inet6_destroy_sock() in SCTP. :-( > >> > >> Looks good to me. > > > > OK, I will send a formal (and tested ;) ) patch. > > I was shortly wondering whether there could be a use-after-free by > doing this after sctp_destroy_sock() due to the sctp_endpoint_destroy() > that would eventually drop a ref on the socket, but the endpoint holds > a separate ref, so we should be good. >
More generically ->destroy() caller must keep a reference on the socket.
inet_csk_destroy_sock() for example uses sk after
sk->sk_prot->destroy(sk);
| |