Re: [PATCH net] ipv6: fix possible use after free of dev stats

2015-06-08 Thread David Miller
From: Robert Shearman Date: Fri, 5 Jun 2015 18:51:54 +0100 > The memory pointed to by idev->stats.icmpv6msgdev, > idev->stats.icmpv6dev and idev->stats.ipv6 can each be used in an RCU > read context without taking a reference on idev. For example, through > IP6_*_STATS_* calls in ip6_rcv. These m

Re: [PATCH net] ipv6: fix possible use after free of dev stats

2015-06-08 Thread Hannes Frederic Sowa
On Fr, 2015-06-05 at 18:51 +0100, Robert Shearman wrote: > The memory pointed to by idev->stats.icmpv6msgdev, > idev->stats.icmpv6dev and idev->stats.ipv6 can each be used in an RCU > read context without taking a reference on idev. For example, through > IP6_*_STATS_* calls in ip6_rcv. These memor

[PATCH net] ipv6: fix possible use after free of dev stats

2015-06-05 Thread Robert Shearman
The memory pointed to by idev->stats.icmpv6msgdev, idev->stats.icmpv6dev and idev->stats.ipv6 can each be used in an RCU read context without taking a reference on idev. For example, through IP6_*_STATS_* calls in ip6_rcv. These memory blocks are freed without waiting for an RCU grace period to ela