lkml.org 
[lkml]   [2018]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH net V2] tun: fix use after free for ptr_ring
    From
    From: Jason Wang <jasowang@redhat.com>
    Date: Fri, 11 May 2018 10:49:25 +0800

    > We used to initialize ptr_ring during TUNSETIFF, this is because its
    > size depends on the tx_queue_len of netdevice. And we try to clean it
    > up when socket were detached from netdevice. A race were spotted when
    > trying to do uninit during a read which will lead a use after free for
    > pointer ring. Solving this by always initialize a zero size ptr_ring
    > in open() and do resizing during TUNSETIFF, and then we can safely do
    > cleanup during close(). With this, there's no need for the workaround
    > that was introduced by commit 4df0bfc79904 ("tun: fix a memory leak
    > for tfile->tx_array").
    >
    > Reported-by: syzbot+e8b902c3c3fadf0a9dba@syzkaller.appspotmail.com
    > Cc: Eric Dumazet <eric.dumazet@gmail.com>
    > Cc: Cong Wang <xiyou.wangcong@gmail.com>
    > Cc: Michael S. Tsirkin <mst@redhat.com>
    > Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
    > Signed-off-by: Jason Wang <jasowang@redhat.com>
    > ---
    > Changes from v1:
    > - free ptr_ring during close()
    > - use tun_ptr_free() during resie for safety

    Applied and queued up for -stable, thanks Jason.

    \
     
     \ /
      Last update: 2018-05-14 20:49    [W:4.967 / U:1.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site