Re: net/ipv4: use-after-free in add_grec

2017-06-01 Thread Andrey Konovalov
On Thu, Jun 1, 2017 at 2:13 AM, Eric Dumazet wrote: > On Wed, 2017-05-31 at 16:55 -0700, Eric Dumazet wrote: > >> The issue here is the timer firing while ip_mc_clear_src() has been >> already called. >> >> My patch should fix the problem. >> >> Or another one using del_timer_sync() instead of del

Re: net/ipv4: use-after-free in add_grec

2017-05-31 Thread Eric Dumazet
On Wed, 2017-05-31 at 16:55 -0700, Eric Dumazet wrote: > The issue here is the timer firing while ip_mc_clear_src() has been > already called. > > My patch should fix the problem. > > Or another one using del_timer_sync() instead of del_timer() in > igmp_stop_timer(), but such a change would be

Re: net/ipv4: use-after-free in add_grec

2017-05-31 Thread Eric Dumazet
On Wed, May 31, 2017 at 4:49 PM, Cong Wang wrote: > On Wed, May 31, 2017 at 9:12 AM, Eric Dumazet wrote: >> On Wed, 2017-05-31 at 11:46 +0200, Andrey Konovalov wrote: >>> Hi, >>> >>> I've got the following error report while fuzzing the kernel with syzkaller. >>> >>> On commit 5ed02dbb497422bf225

Re: net/ipv4: use-after-free in add_grec

2017-05-31 Thread Cong Wang
On Wed, May 31, 2017 at 9:12 AM, Eric Dumazet wrote: > On Wed, 2017-05-31 at 11:46 +0200, Andrey Konovalov wrote: >> Hi, >> >> I've got the following error report while fuzzing the kernel with syzkaller. >> >> On commit 5ed02dbb497422bf225783f46e6eadd237d23d6b (4.12-rc3). >> >> Unfortunately it's

Re: net/ipv4: use-after-free in add_grec

2017-05-31 Thread Eric Dumazet
On Wed, 2017-05-31 at 11:46 +0200, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 5ed02dbb497422bf225783f46e6eadd237d23d6b (4.12-rc3). > > Unfortunately it's not reproducible. > > =

net/ipv4: use-after-free in add_grec

2017-05-31 Thread Andrey Konovalov
Hi, I've got the following error report while fuzzing the kernel with syzkaller. On commit 5ed02dbb497422bf225783f46e6eadd237d23d6b (4.12-rc3). Unfortunately it's not reproducible. == BUG: KASAN: use-after-free in add_grec+0x101e/0