diff options
| author | Jason Wang <jasowang@redhat.com> | 2018-05-16 20:39:33 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-05-16 14:53:10 -0400 |
| commit | 7063efd33bb15abc0160347f89eb5aba6b7d000e (patch) | |
| tree | b60645544d7381dd2337323566ed402620d0e163 /net/tls | |
| parent | fee8fb952d1e1c1a60e2017878a16cf83c92c154 (diff) | |
| download | linux-stable-7063efd33bb15abc0160347f89eb5aba6b7d000e.tar.gz linux-stable-7063efd33bb15abc0160347f89eb5aba6b7d000e.tar.bz2 linux-stable-7063efd33bb15abc0160347f89eb5aba6b7d000e.zip | |
tuntap: fix use after free during release
After commit b196d88aba8a ("tun: fix use after free for ptr_ring") we
need clean up tx ring during release(). But unfortunately, it tries to
do the cleanup blindly after socket were destroyed which will lead
another use-after-free. Fix this by doing the cleanup before dropping
the last reference of the socket in __tun_detach().
Reported-by: Andrei Vagin <avagin@virtuozzo.com>
Acked-by: Andrei Vagin <avagin@virtuozzo.com>
Fixes: b196d88aba8a ("tun: fix use after free for ptr_ring")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tls')
0 files changed, 0 insertions, 0 deletions