Re: [PATCH net-next] net: dsa: avoid potential use-after-free error

2020-11-18 Thread Christian Eggers
On Thursday, 19 November 2020, 00:33:57 CET, Vladimir Oltean wrote: > On Wed, Nov 18, 2020 at 04:43:35PM +0100, Christian Eggers wrote: > > If dsa_switch_ops::port_txtstamp() returns false, clone will be freed > > immediately. Storing the pointer in DSA_SKB_CB(skb)->clone anyway, > > supports annoy

Re: [PATCH net-next] net: dsa: avoid potential use-after-free error

2020-11-18 Thread Vladimir Oltean
On Wed, Nov 18, 2020 at 04:43:35PM +0100, Christian Eggers wrote: > If dsa_switch_ops::port_txtstamp() returns false, clone will be freed > immediately. Storing the pointer in DSA_SKB_CB(skb)->clone anyway, > supports annoying use-after-free bugs. Like what? > Signed-off-by: Christian Eggers > F

[PATCH net-next] net: dsa: avoid potential use-after-free error

2020-11-18 Thread Christian Eggers
If dsa_switch_ops::port_txtstamp() returns false, clone will be freed immediately. Storing the pointer in DSA_SKB_CB(skb)->clone anyway, supports annoying use-after-free bugs. Signed-off-by: Christian Eggers Fixes 146d442c2357 ("net: dsa: Keep a pointer to the skb clone for TX timestamping") ---