From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932208AbdBUSZG (ORCPT ); Tue, 21 Feb 2017 13:25:06 -0500 Received: from shards.monkeyblade.net ([184.105.139.130]:56422 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754736AbdBUSYw (ORCPT ); Tue, 21 Feb 2017 13:24:52 -0500 Date: Tue, 21 Feb 2017 13:24:49 -0500 (EST) Message-Id: <20170221.132449.1868705782244690263.davem@davemloft.net> To: aryabinin@virtuozzo.com Cc: gerrit@erg.abdn.ac.uk, dccp@vger.kernel.org, dvyukov@google.com, edumazet@google.com, xiyou.wangcong@gmail.com, kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org, kaber@trash.net, syzkaller@googlegroups.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] net/dccp: fix use after free in tw_timer_handler() From: David Miller In-Reply-To: <20170221.132351.1602433391866901233.davem@davemloft.net> References: <20170221112740.661-1-aryabinin@virtuozzo.com> <20170221.132351.1602433391866901233.davem@davemloft.net> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=iso-8859-7 X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 21 Feb 2017 09:25:56 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id v1LIPE0G018240 From: David Miller Date: Tue, 21 Feb 2017 13:23:51 -0500 (EST) > From: Andrey Ryabinin > Date: Tue, 21 Feb 2017 14:27:40 +0300 > >> DCCP doesn't purge timewait sockets on network namespace shutdown. >> So, after net namespace destroyed we could still have an active timer >> which will trigger use after free in tw_timer_handler(): > ... >> Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge >> timewait sockets on net namespace destruction and prevent above issue. >> >> Reported-by: Dmitry Vyukov >> Signed-off-by: Andrey Ryabinin > > Applied and queued up for -stable, thanks. Actually, this doesn't even compile. Please fix this up and resubmit: net/dccp/ipv4.c: In function ˇdccp_v4_exit_batch˘: net/dccp/ipv4.c:1022:34: warning: passing argument 2 of ˇinet_twsk_purge˘ makes integer from pointer without a cast [-Wint-conversion] inet_twsk_purge(&dccp_hashinfo, &dccp_death_row, AF_INET); ^ In file included from ./include/linux/dccp.h:14:0, from net/dccp/ipv4.c:13: ./include/net/inet_timewait_sock.h:118:6: note: expected ˇint˘ but argument is of type ˇstruct inet_timewait_death_row *˘ void inet_twsk_purge(struct inet_hashinfo *hashinfo, int family); ^ net/dccp/ipv4.c:1022:2: error: too many arguments to function ˇinet_twsk_purge˘ inet_twsk_purge(&dccp_hashinfo, &dccp_death_row, AF_INET); ^