From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932182AbdBVJel (ORCPT ); Wed, 22 Feb 2017 04:34:41 -0500 Received: from mail-he1eur01on0133.outbound.protection.outlook.com ([104.47.0.133]:4160 "EHLO EUR01-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932129AbdBVJeY (ORCPT ); Wed, 22 Feb 2017 04:34:24 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: [PATCH] net/dccp: fix use after free in tw_timer_handler() To: David Miller References: <20170221112740.661-1-aryabinin@virtuozzo.com> <20170221.132351.1602433391866901233.davem@davemloft.net> <20170221.132449.1868705782244690263.davem@davemloft.net> CC: , , , , , , , , , , From: Andrey Ryabinin Message-ID: Date: Wed, 22 Feb 2017 12:35:20 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <20170221.132449.1868705782244690263.davem@davemloft.net> Content-Type: text/plain; charset="iso-8859-7" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1PR0501CA0009.eurprd05.prod.outlook.com (10.172.9.147) To AM5PR0801MB2051.eurprd08.prod.outlook.com (10.168.158.141) X-MS-Office365-Filtering-Correlation-Id: 601f6769-6593-422c-4a00-08d45b05f927 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:AM5PR0801MB2051; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2051;3:Y/e5RsumK5Mcy3jAy+OhF9UrBBf3fv1DrDSpZ9/aDMOxhHttQCd29rCp9y5VdDBO5pONqrrt/8+Z628VAdwJWdB4Wo+n0aTveYV9jZCJ3OzKI5ZBs5IrCbUA1DhiTYUbmZq3vAiSPFzE8iB8Xf/2a+7/w4BOvVFqh7x5ogngT3PG9wX67mG7w/v86PScHyBlsLWe0Lj8kqkXDFVoaIgl2OWgJ0jjat4wEhksUXBqKS8NacHohuxPvqH8XtT/0WHlnyuldoXn+pigaiH/l28Myg==;25:WF8tecGwStT+Xm2j/9NCj/Je1oqzSU3Cx/3p3VESkBa0EZ2IgZHYxvuP6CCiFOZfdd2W+zeQXyj9dJe7wGwVM8ONYDX+2aL9fyEoMmB5EV2N1ca0SL8CKXIFd+WECpejaNMZUe4gt3NtmcaghkwsISIrycV3s00YF5eXhK+z+aydCLxEWdc8A6Hf3To+ZD3HWHKS0eo68DHSA/gtwdbjMWCtmjWNKRopDPQ5y7EuKMt3vHfBS9ozpaZVnPGjbMZEpYDjSbb6nDbTC/O0yTaJjBYEa5VuiOzvN+QU2/7uq17ZFMh3PvByq4cHXnAobD44bbW7Ssir6JhqeTRiZZ7dgKu//msYejl4TCLeCwnP4gcLNnC8IGVzIS2c/ZCb4paPdh+Zs5hPWDjr/2QcKLYKX8luTXfzRECe9iu7YX1zIF8VCr5U7Wtm/yHv8YgQYH0VRTfF/tGRCwrD7OZxJXdI/Q== X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2051;31:krA+9gvAIe3qy3qL7DBF8GYwZPmMYul3u1yTQrOJti6c1fSRa9JMaW6C8ix3FoA5CwkwnaCq6lXOAD+r3XgVhktBWaYu5HMeJ7oJW9GOK0Yhci2yFRqhrPl4PWfkDeDuCsztZfBVcLtAddHSHncCz6eyN27j4Iy0roPQEMxWVujgZMTHogPI7UZCcGpgUaq/XYLvAGcmBsRYaRtYIRp6bdM9gof0/NpATJaxj7daWzj87wOaKBji+25tD4+cqkv/RNxl9COrkZ30DCpWHskUf536rFEg4SpfRYz3vt//+V0=;20:hU5WJsmdrfCGs1mmsJmlNfs3x8ywIgrisGVSBPpA9g64K3GQEfISjMWqm1YS+FQiSc0YAecmakiBK1U6Vi4POLKiInIrR+2uVBDSsVPwoRjvxuB/MY8HpO8tHGes3awqoWUoBi3ZjOXYd3OPnPK/WYWf7UH4AlXayiJmNOjavw7ae1Dr5s/whHYoj3NDr2UjLNU5VYWu6GEWGqcNtB7k1W4ZuzqeqhV1pD3BB7Kn0mdkUUuL/FD9OkvH+Cpl9dQ1xuNyKDnqXpQuOq6KiG1UD+LCN2TBZYCJ/GUqbyTp4k4cv8DiZq6kJvXoWTf8PtDTCFL6DHB7NdGuUVdN1A4Mg5GsoK9MHCgzYbbDtt+6PGoj3vJpP4xaMiSHNtMf07hVmtuw858K5uA8EV9dA5yyQ9LOwzk2HQi21dxh5vFQZcM= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(211936372134217); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558025)(6072148);SRVR:AM5PR0801MB2051;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB2051; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2051;4:Ajy8fycSJp1VwoTl+9SExMiyYJpAzPwKcR7cjwX2tjYUzpzqT8SlXYKGABecrfiunRegXnPLyoH/2dQO6f35FRZVNAZKYIrSmhOdLK9dBb19jhWP86wG74gxFEm4huoKxL5QJ2Yf3sM/zvePr6kEcIPsQE0YETD9bYh37UXKo5TkXQNuAY5ZTAeI4r5BlMaR9sr+YdXZiK2wd6jnjYAYnqsjPRX0/dpouep87kuf3IodvL0QMhkp56nPt7PDOJ7K+gdSaqNPqMykedmAUQvuQ5iBSGkndcCrn3p96xPbhti/m6sARUalVX7hifQeuLqFzLCTOvkAB5DN4evhiI/7a72x65CKe8c5iYgLH+Utu29L29uQh+7ChSu2akTP3JVUHPiuVxZzpwtqADoJB4oRq4mdcZUqYJr9czk2nIxRDbrsGb0lkwsDzLMDACaikFKByd38ZaeKJWu1sm/vGeBrIuyqqmTO3lktidzhSCGHTpCHv000sMLudTva655FT7IHU7z6zQ3f/CrgSGWRPV2sE837BRFnKj6qTJx6zJBXMSUFVqBDoln/46Q6e+3t/PtY8d8Ik2nyCLpH1xkNj623b//Pnsdw5YB1TR26P39uxOQwI1CSOb8C6RGzMCc1+4Z2Po+h+dox1xXASf2QbnWGJg== X-Forefront-PRVS: 022649CC2C X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39450400003)(199003)(189002)(24454002)(377454003)(4001350100001)(65826007)(7736002)(305945005)(6666003)(189998001)(8676002)(97736004)(92566002)(76176999)(81156014)(81166006)(93886004)(4326007)(68736007)(54906002)(3846002)(54356999)(6116002)(50986999)(2906002)(101416001)(33646002)(47776003)(6246003)(229853002)(65806001)(86362001)(36756003)(6916009)(5660300001)(50466002)(65956001)(53936002)(64126003)(2950100002)(31686004)(83506001)(25786008)(7416002)(6486002)(42186005)(77096006)(230700001)(105586002)(110136004)(38730400002)(31696002)(90366009)(66066001)(106356001)(53546006);DIR:OUT;SFP:1102;SCL:1;SRVR:AM5PR0801MB2051;H:[172.16.25.12];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?iso-8859-7?Q?1;AM5PR0801MB2051;23:FQzxqHZgz9SG2QJIevzi4HULi2Q77+xITwjKl?= =?iso-8859-7?Q?Lt0JbMFIxYCDFGb5yRz8/7vVd+ZNQD5DRSOHo2LbQjzX+mIwy0Pj5b8r3b?= =?iso-8859-7?Q?heI69UhRvaDIspbI7qp05JuB41QMi8bQ3yuwb2fWlTWXsaV4vIIpcptdNI?= =?iso-8859-7?Q?Sh7/CEMYowNfs6vOUTbyPFYLSuk/8vwW7awwDnYnhRdTH6UaiTSwzRqPb9?= =?iso-8859-7?Q?4buptMscjPbkDmIkUgyo9kNAeMDUK+zQVowL6+8P5Sgl+NGvLsXxAp/ut4?= =?iso-8859-7?Q?oCBOk8RM4WWkzlux+zDBtGZaRHXGi2A4FBlmmlDa/AKfX/VpH8Z89oWEKp?= =?iso-8859-7?Q?TPpHCyvVXNUcZnA8L1O9jZsP+8ZIq776jQt8MLLN0MFJ8jCCTfoCIJ97FR?= =?iso-8859-7?Q?Bn++fm8Igy0RUcerp6Q2uiTBBZ/136JxDWfP1EovTJDyJK/6lMNpqa6HMw?= =?iso-8859-7?Q?C6xzFbtV8WzlI2ZN2tWRu3BnIqLg88RuEghPfqWDRIjhdZ6wImcwnBrfZ4?= =?iso-8859-7?Q?RQaDCO8i9LdQycTEhe87i9jTGuZ9D4MKX5LOurGQZW6mQPTOvfk6KsK11s?= =?iso-8859-7?Q?YfviLDYoJ2Tm7AyJjExLXB2tlTDdKYwxnnnbrgyZeP3YbxRpq2qBpOdeoK?= =?iso-8859-7?Q?/W1c48zqMPNeVrmZeGcf5zKgRpGmaPy8IIYqbeSu6DKqopRCnsbv18AEZa?= =?iso-8859-7?Q?x1or9NCIdLni3yToXA0W3u1cA27GoecY1JPUWNu/ZJ9EjTI46RWUeSMjpy?= =?iso-8859-7?Q?GHTKyg/kgpaULfrDfb84zIHvwV5JQfMh2b7GxP4E4vVNhmzTh83ngTzCgu?= =?iso-8859-7?Q?6t0F9tZDQylHgXPRkP9vGbW6S7cc7HYCqSj1ITAiZ65F4nZi5Mb4ddgQBD?= =?iso-8859-7?Q?fmtv5Qq7fYDtguLcWHwr+KRY/pvv4mKi2Pr/2XnlFJ7MHnZ7IqQOUxyYYc?= =?iso-8859-7?Q?Qn84mGSE+l55xP2jX2pBvmhO/h1O7BplvVbjO/9DfyuGZdoWmxWS4OQ50j?= =?iso-8859-7?Q?tmOPeQc3bJAcf6dz9BqkDOT4FZxb//uR3cYAadMVzP6XSumbNyrOu8e4Rd?= =?iso-8859-7?Q?TqrPsVVNRKk0U+03VPy70JV8EaWur5gs7aME9wNd8KmAi8nY1teCqu22/R?= =?iso-8859-7?Q?8QHz0uQqj6/LM2whxL3Ydzw6kNOzbnhD0y5UuNTrQRixWy/RobMr1Z+qX8?= =?iso-8859-7?Q?sCCJsmruhAz9iu65xKlF7zQxu9CGMDIyfQxXCofkl56pCEvzN4t0B18RSs?= =?iso-8859-7?Q?pOjpC688LR/CLP0jESMGDM3GHQS09C1Ax72A1UK/QRPLRxedMJtbRJWMER?= =?iso-8859-7?Q?IKqyz9kHrBfAFE+1tpHlIDVxN8DRlFjqzJNyWb+vULjX64QBZCNx01ZGVm?= =?iso-8859-7?Q?TGDIQMgwn89SggRcQfbH2E/0QMzaCuhwARCPlMOqQ9r9Ma6Lld3pV9Npii?= =?iso-8859-7?Q?iDIRqMTGJ1PN2K1Sp/s37ROHsWLUVpK7VbeElKcbHRcFrAse05BDPbvmbZ?= =?iso-8859-7?Q?0eoi++h+5DCpccfuSOrMng=3D?= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2051;6:tLwlqqoSyLkP3jJkLxBd6OMzQQeZi0RoXF0cjVpxsWRy+Xz8bbvCeWMoOZfFyBl/C9dDbxQlu+F3AAB3JMj4VWNk7kX63lBRa1xdDYdQo3tgK+scZKHo7Pv5EMmPOqoyz6RydhCwKTRmoY28wLd/7MPYfdiG0m9Elhn88IdBiMLFu2XnShQZ/QO3hrdwpo4DqljNOUhxZAEdyrnpbus0Y3m1GtytweOX8OSYBgo/dDI62J+0/zT6HwMLLlNa+fXGSVSh+dBSWpa5gH7fwndRjPoyBkdlhcV8awmgNL6+02XMM2Y7qxxbpcEfrpcXI6pOUehQwpNI3DbOnyuEV6CjEAg9AK11xpBH+oG54p7oItYSkFGinWxb9OpZQq1TUDo1+UfMcw2JZPkdE1LTxxp8dg==;5:xOB1kzFDYi9dq8wJj6FK4bCrw16lI+UnDf0II0H1c2zpcFJC/iF6nB9YFjboqvJfvwK8Vy3CePKogW61+jqNrfaZUNPirmdY/6wsr5qUqjns23Ay2bfVtUob/Dtj/GDPhBoey7IjghN7P5a8BA7qcg==;24:ADaFydrczxQgg8BJDzliRkUAl4iTHFcwcB1dDfURA5UIdF7P6PfnfZ/KPYkouE0JbTO6BG1/osCr11aXHSsGKVhJQGZFXH89JWbLymgppgU= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2051;7:hlQXJEThVfidxBPtx+CgiELnb8qpwsfiu1efjUO2A3rCCxt8tHczUuO7aPPCI4SpMRq6zy/qFJbGWlyGHiPL14wHiQQGHgbGMUIaC5tNJ85QtD80TtrS366XfKiuYLVaD7fdjJzKSNSNuLpt2xCNrwrSYQohyy3lUi+YKAhhT5VyGUu0ocS4zPrz9s3wI3lgAZA256TOQnYNNE5W0aMtbUCMePzpsKYRqVh9MpLyl0SXH/cFYY5pVYZ+auFVMkP1FICFsYpk5DjvkThFb1hjiilo+d7h4LtTZqyi7fxDemHeYHyQu+m4rw25rrFeEOVPllWTPGAgGlQXPWLutOOo1A==;20:qLpx7zYQJDt35xug8RjsFBDCkQFqogjXHzykJ/nZk2DcO+TvCpxko+PRN4nsP/Ozg+bKsz4vaLlDWp1E8ZGYywULng2GkvhFyJ4lMCAAVJSo9voeAYXmIyzGJGKClka7QRLpvHZGTnZ9zOa4jZK98uvw5GOhYSVW86NcqVJnHAc= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Feb 2017 09:34:16.8629 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB2051 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/21/2017 09:24 PM, David Miller wrote: > From: David Miller > Date: Tue, 21 Feb 2017 13:23:51 -0500 (EST) > >> From: Andrey Ryabinin >> Date: Tue, 21 Feb 2017 14:27:40 +0300 >> >>> DCCP doesn't purge timewait sockets on network namespace shutdown. >>> So, after net namespace destroyed we could still have an active timer >>> which will trigger use after free in tw_timer_handler(): >> ... >>> Add .exit_batch hook to dccp_v4_ops()/dccp_v6_ops() which will purge >>> timewait sockets on net namespace destruction and prevent above issue. >>> >>> Reported-by: Dmitry Vyukov >>> Signed-off-by: Andrey Ryabinin >> >> Applied and queued up for -stable, thanks. > > Actually, this doesn't even compile. Please fix this up and resubmit: > Right, I tested this on top of the Linus' tree. Rebased on -next now.