Messages in this thread | ![/](/images/icornerl.gif) | | From | Eric Dumazet <> | Date | Wed, 1 Mar 2017 13:54:26 -0800 | Subject | Re: net: use-after-free in neigh_timer_handler/sock_wfree |
| |
On Wed, Mar 1, 2017 at 1:43 PM, Cong Wang <xiyou.wangcong@gmail.com> wrote: >> >> This one looks very similar to a previous one: >> https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ >> >> Both happen on raw v6 sockets. >> >> For me, it seems the sk refcnt is not correct, skb should still hold >> a refcnt so it should not be freed before kfree_skb() in a timer >> handler... > > More precisely, after this commit: > > commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 > Author: Eric Dumazet <eric.dumazet@gmail.com> > Date: Thu Jun 11 02:55:43 2009 -0700 > > net: No more expensive sock_hold()/sock_put() on each tx > > we don't take (old) refcnt any more on TX path, sk_wmem_alloc > is the new refcnt. ;)
So the bug is that skb->truesize is mangled by reassembly unit, while sbk->sk is tracking sk_wmem_alloc changes in order to decide when it is safe to free sk.
This is why we need to call skb_orphan(), as we did for IPv4 in 8282f27449bf15548
| ![\](/images/icornerr.gif) |