Re: [PATCH] net: Fix double free and memory corruption in get_net_ns_by_id()

2017-12-20 Thread David Miller
From: ebied...@xmission.com (Eric W. Biederman) Date: Tue, 19 Dec 2017 11:27:56 -0600 > (I can trivially verify that that idr_remove in cleanup_net happens > after the network namespace count has dropped to zero --EWB) > > Function get_net_ns_by_id() does not check for net::count > after it has

Re: [PATCH] net: Fix double free and memory corruption in get_net_ns_by_id()

2017-12-20 Thread Nicolas Dichtel
Le 19/12/2017 à 18:27, Eric W. Biederman a écrit : > > (I can trivially verify that that idr_remove in cleanup_net happens > after the network namespace count has dropped to zero --EWB) > > Function get_net_ns_by_id() does not check for net::count > after it has found a peer in netns_ids idr. >

Re: [PATCH] net: Fix double free and memory corruption in get_net_ns_by_id()

2017-12-19 Thread Eric Dumazet
On Tue, 2017-12-19 at 11:27 -0600, Eric W. Biederman wrote: > (I can trivially verify that that idr_remove in cleanup_net happens > after the network namespace count has dropped to zero --EWB) > Reviewed-by: Eric Dumazet Thanks !

[PATCH] net: Fix double free and memory corruption in get_net_ns_by_id()

2017-12-19 Thread Eric W. Biederman
(I can trivially verify that that idr_remove in cleanup_net happens after the network namespace count has dropped to zero --EWB) Function get_net_ns_by_id() does not check for net::count after it has found a peer in netns_ids idr. It may dereference a peer, after its count has already been fina