Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756020AbbHYS2o (ORCPT ); Tue, 25 Aug 2015 14:28:44 -0400 Received: from mail-wi0-f178.google.com ([209.85.212.178]:36715 "EHLO mail-wi0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751989AbbHYS2m (ORCPT ); Tue, 25 Aug 2015 14:28:42 -0400 Date: Tue, 25 Aug 2015 20:28:40 +0200 From: Thomas Graf To: Sasha Levin Cc: davem@davemloft.net, jbenc@redhat.com, roopa@cumulusnetworks.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] route: put lwstate before freeing dst to avoid use after free Message-ID: <20150825182840.GL3707@pox.localdomain> References: <1440527114-12746-1-git-send-email-sasha.levin@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1440527114-12746-1-git-send-email-sasha.levin@oracle.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 628 Lines: 14 On 08/25/15 at 02:25pm, Sasha Levin wrote: > Commit 61adedf3 ("route: move lwtunnel state to dst_entry") is trying to > release lwstate after getting rid of dst, which causes a use-after-free > trying to access dst->lwstate. > > Fixes: 61adedf3 ("route: move lwtunnel state to dst_entry") > Signed-off-by: Sasha Levin Acked-by: Thomas Graf -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/