Re: [PATCH net] ax25: fix possible use-after-free

2019-01-23 Thread Eric Dumazet
On Wed, Jan 23, 2019 at 5:12 PM Cong Wang wrote: > > On Wed, Jan 23, 2019 at 3:42 PM Eric Dumazet wrote: > > > > > > > > On 01/23/2019 03:25 PM, Cong Wang wrote: > > > On Tue, Jan 22, 2019 at 10:41 AM 'Eric Dumazet' via syzkaller > > > wrote: > > >> > > >> syzbot found that ax25 routes where not

Re: [PATCH net] ax25: fix possible use-after-free

2019-01-23 Thread Cong Wang
On Wed, Jan 23, 2019 at 3:42 PM Eric Dumazet wrote: > > > > On 01/23/2019 03:25 PM, Cong Wang wrote: > > On Tue, Jan 22, 2019 at 10:41 AM 'Eric Dumazet' via syzkaller > > wrote: > >> > >> syzbot found that ax25 routes where not properly protected > >> against concurrent use [1]. > >> > >> In this

Re: [PATCH net] ax25: fix possible use-after-free

2019-01-23 Thread Eric Dumazet
On 01/23/2019 03:25 PM, Cong Wang wrote: > On Tue, Jan 22, 2019 at 10:41 AM 'Eric Dumazet' via syzkaller > wrote: >> >> syzbot found that ax25 routes where not properly protected >> against concurrent use [1]. >> >> In this particular report the bug happened while >> copying ax25->digipeat. >>

Re: [PATCH net] ax25: fix possible use-after-free

2019-01-23 Thread Cong Wang
On Tue, Jan 22, 2019 at 10:41 AM 'Eric Dumazet' via syzkaller wrote: > > syzbot found that ax25 routes where not properly protected > against concurrent use [1]. > > In this particular report the bug happened while > copying ax25->digipeat. > > Fix this problem by making sure we call ax25_get_rout

Re: [PATCH net] ax25: fix possible use-after-free

2019-01-23 Thread David Miller
From: Eric Dumazet Date: Tue, 22 Jan 2019 10:40:59 -0800 > syzbot found that ax25 routes where not properly protected > against concurrent use [1]. > > In this particular report the bug happened while > copying ax25->digipeat. > > Fix this problem by making sure we call ax25_get_route() > while

[PATCH net] ax25: fix possible use-after-free

2019-01-22 Thread Eric Dumazet
syzbot found that ax25 routes where not properly protected against concurrent use [1]. In this particular report the bug happened while copying ax25->digipeat. Fix this problem by making sure we call ax25_get_route() while ax25_route_lock is held, so that no modification could happen while using