Re: use-after-free in ip6_setup_cork

2015-11-29 Thread Eric Dumazet
On Sat, 2015-11-28 at 09:23 -0800, Eric Dumazet wrote: > On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote: > > On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > > > Hello, > > > > > > The following program triggers use-after-free in ip6_setup_co

Re: use-after-free in ip6_setup_cork

2015-11-28 Thread Eric Dumazet
On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote: > On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > > Hello, > > > > The following program triggers use-after-free in ip6_setup_cork: > > > > // autogenerated by syzkaller (http://github.c

Re: use-after-free in ip6_setup_cork

2015-11-28 Thread Eric Dumazet
On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > Hello, > > The following program triggers use-after-free in ip6_setup_cork: > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > #include > > int

use-after-free in ip6_setup_cork

2015-11-28 Thread Dmitry Vyukov
Hello, The following program triggers use-after-free in ip6_setup_cork: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include #include #include #include int r1, r3, r4; void *thr0(void *arg) { *(uint64_t*)0x2d90 = 0x2fd3; *(uint64_t*)0x2d98