From: Eric Dumazet <eric.duma...@gmail.com> Date: Fri, 08 Sep 2017 10:16:53 -0700
> On Fri, 2017-09-08 at 09:10 -0700, Cong Wang wrote: >> On Thu, Sep 7, 2017 at 5:52 PM, Subash Abhinov Kasiviswanathan >> <subas...@codeaurora.org> wrote: >> > We are seeing a possible use after free in ip6_dst_destroy. >> > >> > It appears as if memory of the __DST_METRICS_PTR(old) was freed in some >> > path >> > and allocated >> > to ion driver. ion driver has also freed it. Finally the memory is freed by >> > the >> > fib gc and crashes since it is already deallocated. >> >> Does the attach (compile-only) patch help anything? >> >> From my _quick_ glance, it seems we miss the refcnt'ing >> right in __dst_destroy_metrics_generic(). >> >> Thanks! > > But 4.9 kernels do not have yet the DST_METRICS_REFCOUNTED thing, > since this was added in 4.12 It was backported via -stable.
