Re: [PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func

2019-05-06 Thread Zhiqiang Liu
> On Sat, 4 May 2019 15:26:25 +0800 > Zhiqiang Liu wrote: > >> From: Zhiqiang Liu >> >> Follow the following steps: >> # ip netns add net1 >> # export MALLOC_MMAP_THRESHOLD_=0 >> # ip netns list >> then Segmentation fault (core dumped) will occur. >> >> In get_netnsid_from_name func, answer is f

Re: [PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func

2019-05-06 Thread Stephen Hemminger
On Sat, 4 May 2019 15:26:25 +0800 Zhiqiang Liu wrote: > From: Zhiqiang Liu > > Follow the following steps: > # ip netns add net1 > # export MALLOC_MMAP_THRESHOLD_=0 > # ip netns list > then Segmentation fault (core dumped) will occur. > > In get_netnsid_from_name func, answer is freed before

Re: [PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func

2019-05-04 Thread Zhiqiang Liu
> On 5/4/19 1:26 AM, Zhiqiang Liu wrote: >> >> diff --git a/ip/ipnetns.c b/ip/ipnetns.c >> index 430d884..d72be95 100644 >> --- a/ip/ipnetns.c >> +++ b/ip/ipnetns.c >> @@ -107,7 +107,7 @@ int get_netnsid_from_name(const char *name) >> struct nlmsghdr *answer; >> struct rtattr *tb[NETNSA_M

Re: [PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func

2019-05-04 Thread David Ahern
On 5/4/19 1:26 AM, Zhiqiang Liu wrote: > > diff --git a/ip/ipnetns.c b/ip/ipnetns.c > index 430d884..d72be95 100644 > --- a/ip/ipnetns.c > +++ b/ip/ipnetns.c > @@ -107,7 +107,7 @@ int get_netnsid_from_name(const char *name) > struct nlmsghdr *answer; > struct rtattr *tb[NETNSA_MAX + 1];

[PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func

2019-05-04 Thread Zhiqiang Liu
From: Zhiqiang Liu Follow the following steps: # ip netns add net1 # export MALLOC_MMAP_THRESHOLD_=0 # ip netns list then Segmentation fault (core dumped) will occur. In get_netnsid_from_name func, answer is freed before rta_getattr_u32(tb[NETNSA_NSID]), where tb[] refers to answer`s content. I