On 2016年08月11日 16:13, Cornelia Huck wrote:
On Thu, 11 Aug 2016 15:49:12 +0800 Jason Wang <[email protected]> wrote:This looks like a use-after-free. Could you pls try the following patch to see it if fixes your issue? diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c index a38c0da..070e329 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q) rtnl_unlock(); synchronize_rcu(); - skb_array_cleanup(&q->skb_array); sock_put(&q->sk); } @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk) static void macvtap_sock_destruct(struct sock *sk) { struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk); - struct sk_buff *skb; - while ((skb = skb_array_consume(&q->skb_array)) != NULL) - kfree_skb(skb); + skb_array_cleanup(&q->skb_array); } static int macvtap_open(struct inode *inode, struct file *file)Yes, that change fixes things for me. Tested-by: Cornelia Huck <[email protected]> Thanks for the quick reply!
Thanks for the testing. Will send a formal patch shortly.
