Subject: Re: net/packet: use-after-free in packet_rcv_fanout

From: Sowmini Varadhan <[email-masked]>
Date: Sun, 12 Feb 2017 20:42:39 -0500

On (02/10/17 10:02), Eric Dumazet wrote:
> At least, Anoob patch is making a step into the right direction ;)
> https://patchwork.ozlabs.org/patch/726532/

I've not been able to reproduce Dmitry's panic (though I did not try
very hard either) but there's a call to fanout_release from packet_release
before the synchronize_net() - I wonder if this could end up kfree'ing f
when there are threads in the middle of dev_queue_xmit_nit().

--Sowmini