tuntap: fix use after free during release
commitpull/10/head7063efd33b
upstream. After commitb196d88aba
("tun: fix use after free for ptr_ring") we need clean up tx ring during release(). But unfortunately, it tries to do the cleanup blindly after socket were destroyed which will lead another use-after-free. Fix this by doing the cleanup before dropping the last reference of the socket in __tun_detach(). Backport Note :- Upstream commit moves the ptr_ring_cleanup call from tun_chr_close to __tun_detach. Upstream applied that patch after replacing skb_array with ptr_ring. This patch moves the skb_array_cleanup call from tun_chr_close to __tun_detach. Reported-by: Andrei Vagin <avagin@virtuozzo.com> Acked-by: Andrei Vagin <avagin@virtuozzo.com> Fixes:b196d88aba
("tun: fix use after free for ptr_ring") Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
ab75811f71
commit
daf0ca743b
|
@ -575,6 +575,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
|
|||
tun->dev->reg_state == NETREG_REGISTERED)
|
||||
unregister_netdevice(tun->dev);
|
||||
}
|
||||
skb_array_cleanup(&tfile->tx_array);
|
||||
sock_put(&tfile->sk);
|
||||
}
|
||||
}
|
||||
|
@ -2646,7 +2647,6 @@ static int tun_chr_close(struct inode *inode, struct file *file)
|
|||
struct tun_file *tfile = file->private_data;
|
||||
|
||||
tun_detach(tfile, true);
|
||||
skb_array_cleanup(&tfile->tx_array);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue