Messages in this thread | | | Date | Mon, 18 Feb 2019 12:02:14 -0800 (PST) | Subject | Re: [PATCH net v2] net: crypto set sk to NULL when af_alg_release. | From | David Miller <> |
| |
From: Mao Wenan <maowenan@huawei.com> Date: Mon, 18 Feb 2019 10:44:44 +0800
> KASAN has found use-after-free in sockfs_setattr. > The existed commit 6d8c50dcb029 ("socket: close race condition between sock_close() > and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore > that crypto module forgets to set the sk to NULL after af_alg_release. > > KASAN report details as below: > BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150 > Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186 ... > Fixes: 6d8c50dcb029 ("socket: close race condition between sock_close() and sockfs_setattr()") > Signed-off-by: Mao Wenan <maowenan@huawei.com>
Applied and queued up for -stable, thanks.
| |