Messages in this thread | | | Date | Mon, 14 May 2018 14:48:31 -0400 (EDT) | Subject | Re: [PATCH net V2] tun: fix use after free for ptr_ring | From | David Miller <> |
| |
From: Jason Wang <jasowang@redhat.com> Date: Fri, 11 May 2018 10:49:25 +0800
> We used to initialize ptr_ring during TUNSETIFF, this is because its > size depends on the tx_queue_len of netdevice. And we try to clean it > up when socket were detached from netdevice. A race were spotted when > trying to do uninit during a read which will lead a use after free for > pointer ring. Solving this by always initialize a zero size ptr_ring > in open() and do resizing during TUNSETIFF, and then we can safely do > cleanup during close(). With this, there's no need for the workaround > that was introduced by commit 4df0bfc79904 ("tun: fix a memory leak > for tfile->tx_array"). > > Reported-by: syzbot+e8b902c3c3fadf0a9dba@syzkaller.appspotmail.com > Cc: Eric Dumazet <eric.dumazet@gmail.com> > Cc: Cong Wang <xiyou.wangcong@gmail.com> > Cc: Michael S. Tsirkin <mst@redhat.com> > Fixes: 1576d9860599 ("tun: switch to use skb array for tx") > Signed-off-by: Jason Wang <jasowang@redhat.com> > --- > Changes from v1: > - free ptr_ring during close() > - use tun_ptr_free() during resie for safety
Applied and queued up for -stable, thanks Jason.
| |