Messages in this thread | | | From | Cong Wang <> | Date | Tue, 30 Apr 2019 16:33:28 -0700 | Subject | Re: [PATCH] tun: Fix use-after-free in tun_net_xmit |
| |
On Mon, Apr 29, 2019 at 7:44 PM YueHaibing <yuehaibing@huawei.com> wrote: > > With SOCK_RCU_FREE tfile is ok , > > but tfile->sk is freed by sock_put in __tun_detach, it will trgger
SOCK_RCU_FREE is exactly for sock and for sock_put(), you need to look into sock_put() path to see where SOCK_RCU_FREE is tested.
> > use-after-free in tun_net_xmit if tun->numqueues check passed.
Why do you believe we still have use-after-free with SOCK_RCU_FREE?
tun_net_xmit() holds RCU read lock, so with SOCK_RCU_FREE, the sock won't be freed until tun_net_xmit() releases RCU read lock. This is just how RCU works...
| |