From: Eric Dumazet <eduma...@google.com> Date: Fri, 12 Oct 2018 18:58:53 -0700
> syzbot found a use-after-free in inet6_mc_check [1] > > The problem here is that inet6_mc_check() uses rcu > and read_lock(&iml->sflock) > > So the fact that ip6_mc_leave_src() is called under RTNL > and the socket lock does not help us, we need to acquire > iml->sflock in write mode. > > In the future, we should convert all this stuff to RCU. > > [1] > BUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline] > BUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649 > Read of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432 ... > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: syzbot <syzkal...@googlegroups.com> Applied and queued up for -stable, thanks.
