Re: [PATCH] tun: Fix use-after-free in tun_net_xmit
From: Cong Wang <hidden>
Date: 2019-04-30 23:33:43
Also in:
lkml
On Mon, Apr 29, 2019 at 7:44 PM YueHaibing [off-list ref] wrote:
With SOCK_RCU_FREE tfile is ok , but tfile->sk is freed by sock_put in __tun_detach, it will trgger
SOCK_RCU_FREE is exactly for sock and for sock_put(), you need to look into sock_put() path to see where SOCK_RCU_FREE is tested.
use-after-free in tun_net_xmit if tun->numqueues check passed.
Why do you believe we still have use-after-free with SOCK_RCU_FREE? tun_net_xmit() holds RCU read lock, so with SOCK_RCU_FREE, the sock won't be freed until tun_net_xmit() releases RCU read lock. This is just how RCU works...