Re: [PATCH -next v2] unix stream: Fix use-after-free crashes
flat view
From: Yan, Zheng <hidden>
Date: 2011-09-04 08:23:05
On Sun, Sep 4, 2011 at 3:12 PM, Sedat Dilek [off-list ref] wrote:
On Sun, Sep 4, 2011 at 7:44 AM, Yan, Zheng [off-list ref] wrote:quoted
Commit 0856a30409 (Scm: Remove unnecessary pid & credential references in Unix socket's send and receive path) introduced a use-after-free bug. It passes the scm reference to the first skb. Skb(s) afterwards may reference freed data structure because the first skb can be destructed by the receiver at anytime. The fix is by passing the scm reference to the very last skb.s/by passing/bypassing ?
No
quoted
Signed-off-by: Zheng Yan <redacted> Reported-by: Jiri Slaby <redacted> ---Tested on i386 against linux-next (next-20110831).
Thank you.
- Sedat - -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html