Re: [PATCH 1/1] net: possible use after free in dst_release

2016-01-06 Thread David Miller
From: Eric Dumazet Date: Wed, 06 Jan 2016 05:57:24 -0800 > On Wed, 2016-01-06 at 00:18 -0800, Francesco Ruggeri wrote: >> dst_release should not access dst->flags after decrementing >> __refcnt to 0. The dst_entry may be in dst_busy_list and >> dst_gc_task may dst_destroy it before dst_release ge

Re: [PATCH 1/1] net: possible use after free in dst_release

2016-01-06 Thread Eric Dumazet
On Wed, 2016-01-06 at 00:18 -0800, Francesco Ruggeri wrote: > dst_release should not access dst->flags after decrementing > __refcnt to 0. The dst_entry may be in dst_busy_list and > dst_gc_task may dst_destroy it before dst_release gets a chance > to access dst->flags. > > Signed-off-by: Francesc

[PATCH 1/1] net: possible use after free in dst_release

2016-01-06 Thread Francesco Ruggeri
dst_release should not access dst->flags after decrementing __refcnt to 0. The dst_entry may be in dst_busy_list and dst_gc_task may dst_destroy it before dst_release gets a chance to access dst->flags. Signed-off-by: Francesco Ruggeri --- net/core/dst.c | 3 ++- 1 file changed, 2 insertions(+)