Re: [PATCH] net: Fix UAF in ieee80211_scan_rx()

From: Siddh Raman Pant
Date: Tue Jul 26 2022 - 08:17:56 EST


On Tue, 26 Jul 2022 15:37:16 +0530 Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> Note: this is slightly racy.
>
> You are supposed to follow this order in this situation.
>
> 1) Clear the pointer
>
> Then:
>
> 2) wait an rcu grace period (synchronize_rcu()) or use call_rcu()/kfree_rcu().
>

Noted. Due to rcu_dereference() used to get scan_req, null ptr dereference
cannot happen. That had completely missed my eyes, sorry for that.

I will send a v2.

Thanks,
Siddh