Re: use-after-free in ip6_setup_cork

2015-11-29 Thread Eric Dumazet
On Sat, 2015-11-28 at 09:23 -0800, Eric Dumazet wrote: > On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote: > > On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > > > Hello, > > > > > > The following program triggers use-after-free in ip6_setup_cork: > > > > > > // autogenerated by syz

Re: use-after-free in ip6_setup_cork

2015-11-28 Thread Eric Dumazet
On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote: > On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > > Hello, > > > > The following program triggers use-after-free in ip6_setup_cork: > > > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > > #include > > #includ

Re: use-after-free in ip6_setup_cork

2015-11-28 Thread Eric Dumazet
On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > Hello, > > The following program triggers use-after-free in ip6_setup_cork: > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > #include > > int r1, r3, r4; > > void *thr0(void *a