Re: [PATCH net] ipv6: orphan skbs in reassembly unit

2017-03-02 Thread David Miller
From: Eric Dumazet Date: Wed, 01 Mar 2017 14:45:06 -0800 > From: Eric Dumazet > > Andrey reported a use-after-free in IPv6 stack. > > Issue here is that we free the socket while it still has skb > in TX path and in some queues. > > It happens here because IPv6 reassembly unit messes skb->true

Re: [PATCH net] ipv6: orphan skbs in reassembly unit

2017-03-01 Thread Joe Stringer
On 1 March 2017 at 14:45, Eric Dumazet wrote: > From: Eric Dumazet > > Andrey reported a use-after-free in IPv6 stack. > > Issue here is that we free the socket while it still has skb > in TX path and in some queues. > > It happens here because IPv6 reassembly unit messes skb->truesize, > breakin

[PATCH net] ipv6: orphan skbs in reassembly unit

2017-03-01 Thread Eric Dumazet
From: Eric Dumazet Andrey reported a use-after-free in IPv6 stack. Issue here is that we free the socket while it still has skb in TX path and in some queues. It happens here because IPv6 reassembly unit messes skb->truesize, breaking skb_set_owner_w() badly. We fixed a similar issue for IPV4