Commit 104a4933 authored Aug 11, 2016 by Jason Wang Committed by David S. Miller Aug 11, 2016

macvtap: fix use after free for skb_array during release



We've clean skb_array in macvtap_put_queue() but still try to pop from
it during macvtap_sock_destruct(). Fix this use after free by moving
the skb array cleanup to macvtap_sock_destruct() instead.

Fixes: 362899b8 ("macvtap: switch to use skb array")
Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 4b5b9ba5

drivers/net/macvtap.c

+1 −4

Original line number	Diff line number	Diff line
		@@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
		rtnl_unlock();

		synchronize_rcu();
		skb_array_cleanup(&q->skb_array);
		sock_put(&q->sk);
		}

		@@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
		static void macvtap_sock_destruct(struct sock *sk)
		{
		struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk);
		struct sk_buff *skb;

		while ((skb = skb_array_consume(&q->skb_array)) != NULL)
		kfree_skb(skb);
		skb_array_cleanup(&q->skb_array);
		}

		static int macvtap_open(struct inode inode, struct file file)

Admin message