Re: net/packet: use-after-free in packet_rcv_fanout

On (02/10/17 10:02), Eric Dumazet wrote:

At least, Anoob patch is making a step into the right direction ;)
https://patchwork.ozlabs.org/patch/726532/

I've not been able to reproduce Dmitry's panic (though I did not try
very hard either) but there's a call to fanout_release from packet_release
before the synchronize_net() - I wonder if this could end up kfree'ing f
when there are threads in the middle of dev_queue_xmit_nit().

--Sowmini