From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754674AbdBVI6V (ORCPT ); Wed, 22 Feb 2017 03:58:21 -0500 Received: from mail-eopbgr40106.outbound.protection.outlook.com ([40.107.4.106]:47104 "EHLO EUR03-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754496AbdBVI6J (ORCPT ); Wed, 22 Feb 2017 03:58:09 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: [PATCH] net/dccp: fix use after free in tw_timer_handler() To: Arnaldo Carvalho de Melo References: <20170221112740.661-1-aryabinin@virtuozzo.com> <20170221134332.GA5052@kernel.org> CC: "Eric W. Biederman" , Gerrit Renker , "David S. Miller" , , Dmitry Vyukov , Eric Dumazet , Cong Wang , Alexey Kuznetsov , Hideaki YOSHIFUJI , Patrick McHardy , , , From: Andrey Ryabinin Message-ID: <6b21534b-060d-9eac-53f1-7fb3ec448358@virtuozzo.com> Date: Wed, 22 Feb 2017 11:59:03 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <20170221134332.GA5052@kernel.org> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: AM5PR0101CA0011.eurprd01.prod.exchangelabs.com (10.169.240.21) To VI1PR0801MB2061.eurprd08.prod.outlook.com (10.173.74.146) X-MS-Office365-Filtering-Correlation-Id: 02c86b2f-cc97-4987-f075-08d45b00e78e X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1PR0801MB2061; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;3:sjbq/7J9csxkApaOGShLV2mVB+lyz/yfj2V6p0BJKhVd91u5d2OzIcyRAd13UoOnt/rmADpJdHqWUhNBrabd7Iwu2ZdgLTwHar1md2wy5cm3NP9M4oOVhsKVyFhMaIIXjiWOcnoEh2Q27n3BQPtY+O1GGIb2utmfiZKkArrl1nuV1SdA4xldtf82iW801IL4WIB8PFxylrhELtxfgJsox7ZAJaqX+3zDzDRXHKnxvFnACCuoxG2tZRQWXhknJNbnKZkr7CU5nICm/T+rnw3JlQ==;25:kQk3xn+i0TzQnelPf/+ocL9RotvO5U9W98lWgrDGhD68M6ab8mO2M6r40VaLMplsXCa2GMCypxqO5xgy4zv8s6ns4PVW9lb99xNkBFLw1jxV1uY3bf62yU+CMHkCQOLOdav04v0DezAoMeVoiRVZH+Qnx9d4cgQUvxSz7+/DzM9itlKZRXTvKb2fbeoOCJu3PTPnF/gSzZH1dFvvTpUUnTRCKermgqNYIxB7jM2cW8CoBxkXXPMXGfYwcy7w7VawCXGBmv+QqaHA0vthpmdd8WaqlDmZJucS6XMuWIOe4FOaOs2gRBZUpY22Gn9txwDN8nynWapVvwXEEZyBFzfN/Nds0D37dWqo0sGiE/mummKm7/xNwIBFYnEoVgv9cZdl4UCIDGD5gnMOZeStobetDEEzLKrW8xNkn0CeNF+TEabOjz2GfsYFQxthcqT2r4kWP5ipKzbZ2gAvhmRpawS7sg== X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;31:hrfT80IqYA3sfH2wshtIc6Z4g1Uezy+PAHZ5DXoM2UtY6lzrMhVU44TWsnddiaa5BDgdldMSzOH5LNrXCbCavi2ZrbfVZCgm3aKN0RlFMg71JlhJjNSueOR9LmSkKdOuSOJmJkIyGOt1E/qPRSCAcZ/43DOAchBaEl6B7bzM+FIPUoTdV0VYuMU7Q6uvHglgkYVyMsUQu9mSOTcMhxpVNWJJO6YNLaZWEerCEAaSXixRZ0lJi6mCHuP/mnwOSGSHPdJPWLJGN6wl9cUHVlR5Kg==;20:EA/hqH/TH4sC+DbGQiZ4dd57C2Ii4HXvIlrDrUMTEt+gRuKJNWHRQdkG2FDKhgNb0itFedPLmPdy//Xb+OBOVahVml7h8AMo2v7An41oHZf21PN98CjSKVhqVSk2ZDC5r45z4JYIsIOmibDFfE/9Zv/wOh+Sto85jkV4JS1WRoHSPZ4/kh/IO7pbYIKXzNLXmm44EcuR3+8DI31p8s6BsQPGGxLk1MdPg+pyJak55gaNqZqlYJ9OetXb4uy9nu+qlmTseP5qKNCO0x4rYu8QhVt89a1t8FkWBiTw1JHzEEESSrJ5jKoYTrtZMsL6XlLuqX1ZHoVlRl7xfA5nYyLexdnHT0y6MhLQUZRdQOIvXQJ9qP9sgOUjDqBjG4LutxNx0m8maVbuellyddoCCNuoQ7nOBYgzmGpNNUq4G9l76eM= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123558025)(20161123560025)(6072148);SRVR:VI1PR0801MB2061;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB2061; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;4:+yzE6x1KoZ1xpTIwbF6me9CRgQ24MVdJbZJuH/90pRCBzaMr4qeFA7Dp9uh6nK19EQ7GsK91sE+p0HoEOwyX3Ca6WvNSQ2LxcfdME69RI7Wp8WdzFHxVAVdwXf4Zc7oEDWstRh7Zxhzly4X1rKfgSs1hWnFlzUze6oWOvwMxmuiyPjA87lgQQJEPgjSggKmobE2GMlmHTN9Yw4Eg37IRrR0SHwzRzxO4CSI1p1dOoKvKBE9eg1OlVNXIB6zoUg8GZHAbIF5B/wpOwGckeRLnI9Kz2ON6sKp+ibOB1WkMPpRMMeJO9htyfoGrFo+rtootVCyIhxnYx88soOag/mdQwB6o0IPn/fjU79Kfs35Ur+g8sFw0dHd8rj7Xmyi+dYMf12kuqeTMinXkMl2+5Kon7E2cOY/pK5Laakjm4IHM1a82LkPvX5+FlL0AQdbLZuPFfH3+5Wh19wsT944+1CEWgD9PIa8crH2lEmlhsvg56BkeFmtZBmZJgsO1p2QYpd+EKXjcbU8e+g2dfXrIe6TJBTIruTiqzyCmHp8Av1EIITozpLdgwRDjTrTa7o0UdfvXgdg3KBuJhzORGFzCPp40XiRx/edwNxZkDQDZ1KsHeF4= X-Forefront-PRVS: 022649CC2C X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39410400002)(39830400002)(39450400003)(24454002)(377454003)(189002)(199003)(189998001)(7736002)(50986999)(305945005)(68736007)(81166006)(105586002)(36756003)(106356001)(3846002)(2906002)(64126003)(6116002)(7416002)(5660300001)(97736004)(54356999)(23746002)(53936002)(101416001)(76176999)(92566002)(4326007)(65806001)(8676002)(4001350100001)(33646002)(65956001)(25786008)(50466002)(38730400002)(47776003)(42186005)(31686004)(83506001)(81156014)(230700001)(77096006)(66066001)(90366009)(6486002)(6246003)(31696002)(229853002)(2950100002)(6916009)(86362001)(53546006)(54906002)(6666003)(65826007)(110136004);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB2061;H:[172.16.25.12];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;VI1PR0801MB2061;23:DWxoS2joGbThRWk2ZvS8gCbRlZdTL1Ags90?= =?Windows-1252?Q?YSMW6/+fgZ4btzv0SnVBcd9LVirguBDZ7sHkbYrBOvg2DJT3/vg51ijJ?= =?Windows-1252?Q?dAtEUkecpAbkuiHXvm5yRlEFTQpAPPeiNdNMwPLwE90flGGVS8QQauqA?= =?Windows-1252?Q?Pb2N0aGoGds1e1wJxmFqlxj6n40j1QLDn708ti1pdgf70qHTNiRwmm48?= =?Windows-1252?Q?5nbg/Voi6q+Jdyx2GwI7RaV1Zh3QtlxfsRdTM89g1Q7uiY1wSEjD6rZD?= =?Windows-1252?Q?SFcnyQNME7PkWG43lM/N4zXMyOIP5k0PGVkc3SoTdLD9OKkCqVbYGB07?= =?Windows-1252?Q?g1riGZLzqu3JG4i6WLcVcWSv9CzPQVquUXvEEzw31ejEWADB/3xDZ09V?= =?Windows-1252?Q?KjPv9H5U1e2ug8GGkrmPfNIlUBWAuxHJjU4/yMmiwYsmkdwb458GKtQO?= =?Windows-1252?Q?jBZzIhvlmO8+6QIuHgdhP2Ckd/XsKQyTlmSfGapb4tC3bgGck1n0tUsF?= =?Windows-1252?Q?ZbN9RELxxDeOE9zM6/uNH1A9VrnCnVPww99p9llgkA+QrnxzNnLKylYp?= =?Windows-1252?Q?JUTc6nsjD5Ocs2QoOx2C47QbiaS6IMQw8O8bgOIB+oIrNEs0Uhj+vdsz?= =?Windows-1252?Q?9JY156MKCzBJF89NEYZfF5P2luW9F+VOSte3l25JhW5tcJ2t1eJXzGRb?= =?Windows-1252?Q?9u8ZwWZsZT0nlDoh1clCrPE562Wpz3wZx7ErLqcXg5USIKjuWhsWLVav?= =?Windows-1252?Q?CLhSo5DqT+VklSG6A2wZQ3P0fHE4ExZbA4PzS2KGK5BpuIIg8dsba28A?= =?Windows-1252?Q?hysjnRSZpsDjSq9hs2/9qNUHSWuqo6H/bGc7+5Flw83kL2NgvKZH9i56?= =?Windows-1252?Q?7vfMcbKWQjcQvghr8d8iGbS3m3e/3X/PsoN46OatsSUwgonG6HMfBwLy?= =?Windows-1252?Q?ntFJezHQrqxbd0EmA40X4tEVMK/XbBksntWmOp1tagH8RN+7Z8m5CaBR?= =?Windows-1252?Q?yAWSA4Bt4ipy/3GOVVolSslnqRAbaJHgHWFecq0mP3JCZJcNurbNIAqY?= =?Windows-1252?Q?1F+ySETgBtavb1ULfq/C3u9Na+0xuoDIqyOGkbStg0Q/YlaUmoid39og?= =?Windows-1252?Q?ppO8JCInBvQrXDTGNMCZPFRE5sPK8FaYUKX3aMUNmaN8VlV7sKpEcXXf?= =?Windows-1252?Q?xabo7qjSfHpR0/bkVmofMRtBqjL4J04t2BJ9Np9AenJwerwXi/3vlioK?= =?Windows-1252?Q?OZaarkTRmJB3z1CdvHOm1HerS1kJy5T+4INaHsdipAneA7Ck4YIoiCw/?= =?Windows-1252?Q?qbyr4Q5HM+fRpgPGTq9/okcy2XKnWXWB5Bg+Y3uuwAiss5Apu5gQ6Ktp?= =?Windows-1252?Q?vLgoyIu9++mLk8arYlj30qUCDf0JdQ+A1iVrKavkHUK5RAH/kLMqq204?= =?Windows-1252?Q?+MDCiopcSRzP3gMUAWh3qZlrxZ/VTlXo/sYsL141xpoEdrhvfStLdXPS?= =?Windows-1252?Q?Yz6ZnPTpMVgQyvFv0duJrgjLV4jziKjrTn0eBSf53LeKGkuetM9h3mTd?= =?Windows-1252?Q?SS5ej9osCdAojXrgR0jtq6r5ZTAIpjxpk2eQCD61ups7dQhu9NHfOv4W?= =?Windows-1252?Q?DNB7n0hvH2H4Vkkn2the2ZAE=3D?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;6:qJ1DD7VMymXmyBhJexbxCKtPxMVfcbHzITSqIQ6j3OxbJU57vV7gte+yG6Bvnw1nO3maQW4di5sCh3st2quwuxZ+3p3YrL/xMQrRNHQ9iEEeTrbCFm1EdlJgc/vCJ0nYihnWb+FMdhIiVJmUgR90Tt9WBmFfpuUt3POAaJLe0s73C2nxjZQNrThzExYyI7wu06RKNBQYj7LWgBQw1JcfZMBoUQQ1KJrxUB/bEeENZKmZGcvdoggDdNavfSuVg7jhysmWuTTG6FqjrSN0RJ0olNNrHwW4boJq/RsiSamyyS33JvJmUuWST0KKCQLy3WNk4PG+2GJ0LiBYuF3yT7R+/oGfS1VUg8ivzfMTqQCMLd3WIed2/aAODCjHe59hDqMTa8ZrVzKx2Lh1rxe/j1Sn5w==;5:hOD2LkIXJhmvnekQ360Oe/cPq1jDVOXl4ivbaO/WjaNpcN0hXo48zAmq0yqF6gE5nLXEhfIUT2VD2HpcakrMhxdTXLYk6atGKTSlZqqhPb4gzOS71wPrR6MVDvk4l9eekLxCi6v+GK+dldv48auCAQ0XltcvK6wHQjAkYgO0LmU=;24:dePt9hto3P+opyRoh0/LB5RpIas41GDFWCosIk74GXC1bJvZwIzC3yxdZ4IEbmvSPHTpO2lA5QqTOec0uQduqccZ9z/E3WT5yJDOcGVEtbM= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;7:Er2hX5Zvri8czy6fW95myr0EWJhgf8d5PJRmIr+sZ1gRFVP227RqezVZyQ73tcr95rEPmEqnRPXW1wLlJrzO0rajzBzVuvrUNCOxesj+WFpRSdaMKOPXBypzARKkhkTIBUb6ijgYc40EvvmnZoHNOIz/+ruqSj5AFHZjc0kUsWONqOjCJtuVFiLw1GPHIv7NcbY7vuCbf8/X6ArIeEq1p6fjanYjlLXr0JgZhePd+LWNh2lHEN4K+OjgsfF9mX5l1bVD+pzUPKjoSiN7/NLX0MVtQ0Ub2kb+fHkEqyXLZv2lBGPWZZp82vYMV8+PdTYUbslN1FOM3+HvwK7mYzZMiQ==;20:DOC4MHgh3KgUatGlZ4xR0ed1gK3ic6KP0NpPZMluVOydVJimwd2TqJbHQeSfbJGXZrmmIoQmL6TRIRoUyT6dwvt0HgT7xFwd8NUeHMHwizvA7FG4vNJ+Ug4G90+gxRkeIHi4BpN3HjWeAXW0jPg03OuDmnZXupn4ILxDK2nIVkA= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2017 08:57:59.8465 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2061 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/21/2017 04:43 PM, Arnaldo Carvalho de Melo wrote: > Em Tue, Feb 21, 2017 at 02:27:40PM +0300, Andrey Ryabinin escreveu: >> DCCP doesn't purge timewait sockets on network namespace shutdown. >> So, after net namespace destroyed we could still have an active timer >> which will trigger use after free in tw_timer_handler(): >> >> >> Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge >> timewait sockets on net namespace destruction and prevent above issue. > > Please add this, to help stable kernels to pick this up > > Fixes: b099ce2602d8 ("net: Batch inet_twsk_purge") > Cc: Eric W. Biederman > Fixes tag should blame commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH"). It introduced use of net namespace in the timer callback.