Messages in this thread | | | Subject | Re: [PATCH v0] mctp: defer the kfree of object mdev->addrs | From | patchwork-bot+netdevbpf@kernel ... | Date | Tue, 26 Apr 2022 07:50:10 +0000 |
| |
Hello:
This patch was applied to netdev/net.git (master) by Paolo Abeni <pabeni@redhat.com>:
On Fri, 22 Apr 2022 19:43:40 +0800 you wrote: > The function mctp_unregister() reclaims the device's relevant resource > when a netcard detaches. However, a running routine may be unaware of > this and cause the use-after-free of the mdev->addrs object. > > The race condition can be demonstrated below > > cleanup thread another thread > | > unregister_netdev() | mctp_sendmsg() > ... | ... > mctp_unregister() | rt = mctp_route_lookup() > ... | mctl_local_output() > kfree(mdev->addrs) | ... > | saddr = rt->dev->addrs[0]; > | > > [...]
Here is the summary with links: - [v0] mctp: defer the kfree of object mdev->addrs https://git.kernel.org/netdev/net/c/b561275d633b
You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
| |