Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753602AbdCAXLp (ORCPT ); Wed, 1 Mar 2017 18:11:45 -0500 Received: from mail-wr0-f171.google.com ([209.85.128.171]:33474 "EHLO mail-wr0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753099AbdCAXLh (ORCPT ); Wed, 1 Mar 2017 18:11:37 -0500 MIME-Version: 1.0 In-Reply-To: References: From: Cong Wang Date: Wed, 1 Mar 2017 15:09:12 -0800 Message-ID: Subject: Re: net: use-after-free in neigh_timer_handler/sock_wfree To: Eric Dumazet Cc: Dmitry Vyukov , David Miller , netdev , LKML , syzkaller , Alexey Kuznetsov , James Morris Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1312 Lines: 37 On Wed, Mar 1, 2017 at 1:54 PM, Eric Dumazet wrote: > On Wed, Mar 1, 2017 at 1:43 PM, Cong Wang wrote: >>> >>> This one looks very similar to a previous one: >>> https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ >>> >>> Both happen on raw v6 sockets. >>> >>> For me, it seems the sk refcnt is not correct, skb should still hold >>> a refcnt so it should not be freed before kfree_skb() in a timer >>> handler... >> >> More precisely, after this commit: >> >> commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 >> Author: Eric Dumazet >> Date: Thu Jun 11 02:55:43 2009 -0700 >> >> net: No more expensive sock_hold()/sock_put() on each tx >> >> we don't take (old) refcnt any more on TX path, sk_wmem_alloc >> is the new refcnt. ;) > > So the bug is that skb->truesize is mangled by reassembly unit, > while sbk->sk is tracking sk_wmem_alloc changes in order > to decide when it is safe to free sk. That is my suspicion as well, skb->truesize is updated somewhere but sk->sk_wmem_alloc isn't, so leads to this bug. > > This is why we need to call skb_orphan(), as we did for IPv4 in > 8282f27449bf15548 But I doubt skb_orphan() is the solution here, shouldn't we just update sk->sk_wmem_alloc with skb->truesize changes?