Re: net/ipv4: use-after-free in ipv4_datagram_support_cmsg

[Willem de Bruijn]

===================
> BUG: KASAN: use-after-free in ipv4_datagram_support_cmsg
> net/ipv4/ip_sockglue.c:500 [inline] at addr ffff880059be0128

Thanks for the report. This is accessing skb->dev from within recvmsg() at line

        info->ipi_ifindex = skb->dev->ifindex;

Introduced in 829ae9d61165 ("net-timestamp: allow reading recv cmsg on
errqueue with origin tstamp"). At this time the device may indeed have
gone away. I'm having a look at a way to read this in the receive BH
and store the ifindex.