From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966214AbbLQLl1 (ORCPT ); Thu, 17 Dec 2015 06:41:27 -0500 Received: from lxorguk.ukuu.org.uk ([81.2.110.251]:49444 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750938AbbLQLlZ (ORCPT ); Thu, 17 Dec 2015 06:41:25 -0500 Date: Thu, 17 Dec 2015 11:41:04 +0000 From: One Thousand Gnomes To: Dmitry Vyukov Cc: Andreas Koensgen , linux-hams@vger.kernel.org, netdev , LKML , Greg Kroah-Hartman , Jiri Slaby , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet Subject: Re: use-after-free in sixpack_close Message-ID: <20151217114104.6946d72b@lxorguk.ukuu.org.uk> In-Reply-To: References: Organization: Intel Corporation X-Mailer: Claws Mail 3.12.0 (GTK+ 2.24.28; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > This report is then followed by a dozen of other use-after-free reports. > > On commit edb42dc7bc0da0125ceacab810a553ce1f0cac8d (Dec 15). > > Thank you sixpack_close does unregister_netdev(sp->dev), which frees sp as sp is actually allocated via alloc_netdev() Then deletes two timers within sp Then frees two buffers indexed off sp The mkiss driver also appears to share the same bug and references ax->rbuff/xbuff after they have been freed, and then writes to ax->tty. Alan