lkml.org 
[lkml]   [2022]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v0] mctp: defer the kfree of object mdev->addrs
From
Date
Hello:

This patch was applied to netdev/net.git (master)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 22 Apr 2022 19:43:40 +0800 you wrote:
> The function mctp_unregister() reclaims the device's relevant resource
> when a netcard detaches. However, a running routine may be unaware of
> this and cause the use-after-free of the mdev->addrs object.
>
> The race condition can be demonstrated below
>
> cleanup thread another thread
> |
> unregister_netdev() | mctp_sendmsg()
> ... | ...
> mctp_unregister() | rt = mctp_route_lookup()
> ... | mctl_local_output()
> kfree(mdev->addrs) | ...
> | saddr = rt->dev->addrs[0];
> |
>
> [...]

Here is the summary with links:
- [v0] mctp: defer the kfree of object mdev->addrs
https://git.kernel.org/netdev/net/c/b561275d633b

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html


\
 
 \ /
  Last update: 2022-04-26 09:52    [W:0.124 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site