On Fri, Jun 9, 2017 at 8:59 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote:
> On Thu, Jun 8, 2017 at 1:33 PM, Eric Dumazet <eric.duma...@gmail.com> wrote: >> I mentioned (in https://lkml.org/lkml/2017/5/31/619 ) that we might need >> to defer freeing after rcu grace period but for some reason decided it >> was not needed. Yes, this one could fix it. > > This one makes sense, it is the second time I saw the use-after-free > in igmp code, both are because we don't respect the RCU rule to free > an element in the list. > >> >> What about : > > But not sure if all ip_ma_put() callers want ip_mc_clear_src(). If that's problem, there may be another way: leave ip_mc_clear_src as it is, just add pmc->lock to protect this call. this use-after-free was actually caused by using pmc->sources/tomb in add_grec while ip_mc_clear_src is freeing them. add_grec is already under pmc->lock, so to add pmc->lock for ip_mc_clear_src should be enough to protect the list pmc->sources/tomb. wdyt ?
