On Fri, 2017-09-08 at 10:19 -0700, David Miller wrote: > From: Eric Dumazet <eric.duma...@gmail.com> > Date: Fri, 08 Sep 2017 10:16:53 -0700 > > > On Fri, 2017-09-08 at 09:10 -0700, Cong Wang wrote: > >> On Thu, Sep 7, 2017 at 5:52 PM, Subash Abhinov Kasiviswanathan > >> <subas...@codeaurora.org> wrote: > >> > We are seeing a possible use after free in ip6_dst_destroy. > >> > > >> > It appears as if memory of the __DST_METRICS_PTR(old) was freed in some > >> > path > >> > and allocated > >> > to ion driver. ion driver has also freed it. Finally the memory is freed > >> > by > >> > the > >> > fib gc and crashes since it is already deallocated. > >> > >> Does the attach (compile-only) patch help anything? > >> > >> From my _quick_ glance, it seems we miss the refcnt'ing > >> right in __dst_destroy_metrics_generic(). > >> > >> Thanks! > > > > But 4.9 kernels do not have yet the DST_METRICS_REFCOUNTED thing, > > since this was added in 4.12 > > It was backported via -stable.
I hate working on lazy bug reports.
