Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755170AbdGWRD4 (ORCPT ); Sun, 23 Jul 2017 13:03:56 -0400 Received: from mail-wm0-f52.google.com ([74.125.82.52]:34988 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751520AbdGWRDy (ORCPT ); Sun, 23 Jul 2017 13:03:54 -0400 MIME-Version: 1.0 In-Reply-To: <4F88C5DDA1E80143B232E89585ACE27D018CB6E0@DGGEMA502-MBS.china.huawei.com> References: <20170410190350.ngfw435zzr7gpw7e@sasha-lappy> <20170410192309.35x7ddya2cyyv4y6@codemonkey.org.uk> <4F88C5DDA1E80143B232E89585ACE27D018C33F1@DGGEMA502-MBX.china.huawei.com> <4F88C5DDA1E80143B232E89585ACE27D018CB6E0@DGGEMA502-MBS.china.huawei.com> From: Cong Wang Date: Sun, 23 Jul 2017 10:03:32 -0700 Message-ID: Subject: Re: af_packet: use after free in prb_retire_rx_blk_timer_expired To: "liujian (CE)" Cc: Dingtianhong , Willem de Bruijn , Dave Jones , "alexander.levin@verizon.com" , "davem@davemloft.net" , "edumazet@google.com" , "willemb@google.com" , "daniel@iogearbox.net" , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1029 Lines: 29 On Sun, Jul 23, 2017 at 5:48 AM, liujian (CE) wrote: > Hi > > I find it caused by below steps: > 1. set tp_version to TPACKET_V3 and req->tp_block_nr to 1 > 2. set tp_block_nr to 0 > Then pg_vec was freed, and we did not delete the timer? Thanks for testing! Ah, I overlook the initialization case in my previous patch. How about the following one? Does it cover all the cases? diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 008bb34ee324..0615c2a950fa 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4329,7 +4329,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, register_prot_hook(sk); } spin_unlock(&po->bind_lock); - if (closing && (po->tp_version > TPACKET_V2)) { + if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ if (!tx_ring) prb_shutdown_retire_blk_timer(po, rb_queue);