On Fri, 2017-09-08 at 09:10 -0700, Cong Wang wrote: > On Thu, Sep 7, 2017 at 5:52 PM, Subash Abhinov Kasiviswanathan > <subas...@codeaurora.org> wrote: > > We are seeing a possible use after free in ip6_dst_destroy. > > > > It appears as if memory of the __DST_METRICS_PTR(old) was freed in some path > > and allocated > > to ion driver. ion driver has also freed it. Finally the memory is freed by > > the > > fib gc and crashes since it is already deallocated. > > Does the attach (compile-only) patch help anything? > > From my _quick_ glance, it seems we miss the refcnt'ing > right in __dst_destroy_metrics_generic(). > > Thanks!
But 4.9 kernels do not have yet the DST_METRICS_REFCOUNTED thing, since this was added in 4.12
