Messages in this thread | | | Subject | Re: [PATCH net v2] net: rose: fix UAF bug caused by rose_t0timer_expiry | From | patchwork-bot+netdevbpf@kernel ... | Date | Thu, 07 Jul 2022 03:00:13 +0000 |
| |
Hello:
This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>:
On Tue, 5 Jul 2022 20:56:10 +0800 you wrote: > There are UAF bugs caused by rose_t0timer_expiry(). The > root cause is that del_timer() could not stop the timer > handler that is running and there is no synchronization. > One of the race conditions is shown below: > > (thread 1) | (thread 2) > | rose_device_event > | rose_rt_device_down > | rose_remove_neigh > rose_t0timer_expiry | rose_stop_t0timer(rose_neigh) > ... | del_timer(&neigh->t0timer) > | kfree(rose_neigh) //[1]FREE > neigh->dce_mode //[2]USE | > > [...]
Here is the summary with links: - [net,v2] net: rose: fix UAF bug caused by rose_t0timer_expiry https://git.kernel.org/netdev/net/c/148ca0451807
You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
| |