Re: [PATCH net] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()

2020-06-16 Thread Taehee Yoo
On Tue, 16 Jun 2020 at 10:17, David Miller wrote: > Hi David, Thank you for the review :) > From: Taehee Yoo > Date: Mon, 15 Jun 2020 15:07:51 + > > > In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses > > fallback tunnel device pointer, which is fb_tunnel_dev. > > T

Re: [PATCH net] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()

2020-06-15 Thread David Miller
From: Taehee Yoo Date: Mon, 15 Jun 2020 15:07:51 + > In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses > fallback tunnel device pointer, which is fb_tunnel_dev. > This pointer is protected by RTNL. It's not enough to be used > in the datapath. > So, this pointer would

[PATCH net] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()

2020-06-15 Thread Taehee Yoo
In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses fallback tunnel device pointer, which is fb_tunnel_dev. This pointer is protected by RTNL. It's not enough to be used in the datapath. So, this pointer would be used after an interface is deleted. It eventually results in th