Re: [PATCH] net: ipconfig: fix ic_close_devs() use-after-free

2017-03-27 Thread David Miller
From: Mark Rutland Date: Mon, 27 Mar 2017 18:00:14 +0100 > Our chosen ic_dev may be anywhere in our list of ic_devs, and we may > free it before attempting to close others. When we compare d->dev and > ic_dev->dev, we're potentially dereferencing memory returned to the > allocator. This causes KA

[PATCH] net: ipconfig: fix ic_close_devs() use-after-free

2017-03-27 Thread Mark Rutland
Our chosen ic_dev may be anywhere in our list of ic_devs, and we may free it before attempting to close others. When we compare d->dev and ic_dev->dev, we're potentially dereferencing memory returned to the allocator. This causes KASAN to scream for each subsequent ic_dev we check. As there's a 1-