Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-22 Thread syzbot
Bisection is inconclusive: the first bad commit could be any of: 2c43838c sched/isolation: Enable CONFIG_CPU_ISOLATION=y by default bf29cb23 sched/isolation: Make CONFIG_NO_HZ_FULL select CONFIG_CPU_ISOLATION d94d1053 sched/isolation: Document boot parameters dependency on

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-18 Thread zhong jiang
On 2019/3/17 3:42, Andrea Arcangeli wrote: > On Sat, Mar 16, 2019 at 05:38:54PM +0800, zhong jiang wrote: >> On 2019/3/16 5:39, Andrea Arcangeli wrote: >>> On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: I can reproduce the issue in arm64 qemu machine. The issue will leave

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-16 Thread Andrea Arcangeli
On Sat, Mar 16, 2019 at 05:38:54PM +0800, zhong jiang wrote: > On 2019/3/16 5:39, Andrea Arcangeli wrote: > > On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: > >> I can reproduce the issue in arm64 qemu machine. The issue will leave > >> after applying the > >> patch. > >> > >>

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-16 Thread zhong jiang
On 2019/3/16 5:39, Andrea Arcangeli wrote: > On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: >> I can reproduce the issue in arm64 qemu machine. The issue will leave after >> applying the >> patch. >> >> Tested-by: zhong jiang > Thanks a lot for the quick testing! > >> Meanwhile,

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-15 Thread Andrea Arcangeli
On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: > I can reproduce the issue in arm64 qemu machine. The issue will leave after > applying the > patch. > > Tested-by: zhong jiang Thanks a lot for the quick testing! > Meanwhile, I just has a little doubt whether it is necessary to

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-07 Thread zhong jiang
On 2019/3/6 10:05, Andrea Arcangeli wrote: > Hello everyone, > > [ CC'ed Mike and Peter ] > > On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote: >> On 2019/3/5 14:26, Dmitry Vyukov wrote: >>> On Mon, Mar 4, 2019 at 4:32 PM zhong jiang wrote: On 2019/3/4 22:11, Dmitry Vyukov wrote:

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-06 Thread zhong jiang
On 2019/3/7 2:29, Andrea Arcangeli wrote: > Hello Zhong, > > On Wed, Mar 06, 2019 at 09:07:00PM +0800, zhong jiang wrote: >> The patch use call_rcu to delay free the task_struct, but It is possible to >> free the task_struct >> ahead of get_mem_cgroup_from_mm. is it right? > Yes it is possible to

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-06 Thread Andrea Arcangeli
Hello Zhong, On Wed, Mar 06, 2019 at 09:07:00PM +0800, zhong jiang wrote: > The patch use call_rcu to delay free the task_struct, but It is possible to > free the task_struct > ahead of get_mem_cgroup_from_mm. is it right? Yes it is possible to free before get_mem_cgroup_from_mm, but if it's

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-06 Thread zhong jiang
On 2019/3/6 16:12, Peter Xu wrote: > On Wed, Mar 06, 2019 at 03:41:06PM +0800, zhong jiang wrote: >> On 2019/3/6 14:26, Mike Rapoport wrote: >>> Hi, >>> >>> On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote: On 2019/3/6 10:05, Andrea Arcangeli wrote: > Hello everyone, >

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-06 Thread Mike Rapoport
On Wed, Mar 06, 2019 at 03:41:06PM +0800, zhong jiang wrote: > On 2019/3/6 14:26, Mike Rapoport wrote: > > Hi, > > > > On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote: > >> On 2019/3/6 10:05, Andrea Arcangeli wrote: > >>> Hello everyone, > >>> > >>> [ CC'ed Mike and Peter ] > >>> > >>>

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-06 Thread Peter Xu
On Wed, Mar 06, 2019 at 03:41:06PM +0800, zhong jiang wrote: > On 2019/3/6 14:26, Mike Rapoport wrote: > > Hi, > > > > On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote: > >> On 2019/3/6 10:05, Andrea Arcangeli wrote: > >>> Hello everyone, > >>> > >>> [ CC'ed Mike and Peter ] > >>> > >>>

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-05 Thread zhong jiang
On 2019/3/6 14:26, Mike Rapoport wrote: > Hi, > > On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote: >> On 2019/3/6 10:05, Andrea Arcangeli wrote: >>> Hello everyone, >>> >>> [ CC'ed Mike and Peter ] >>> >>> On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote: On 2019/3/5

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-05 Thread Mike Rapoport
Hi, On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote: > On 2019/3/6 10:05, Andrea Arcangeli wrote: > > Hello everyone, > > > > [ CC'ed Mike and Peter ] > > > > On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote: > >> On 2019/3/5 14:26, Dmitry Vyukov wrote: > >>> On Mon, Mar 4,

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-05 Thread zhong jiang
On 2019/3/6 10:05, Andrea Arcangeli wrote: > Hello everyone, > > [ CC'ed Mike and Peter ] > > On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote: >> On 2019/3/5 14:26, Dmitry Vyukov wrote: >>> On Mon, Mar 4, 2019 at 4:32 PM zhong jiang wrote: On 2019/3/4 22:11, Dmitry Vyukov wrote:

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-05 Thread Andrea Arcangeli
Hello everyone, [ CC'ed Mike and Peter ] On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote: > On 2019/3/5 14:26, Dmitry Vyukov wrote: > > On Mon, Mar 4, 2019 at 4:32 PM zhong jiang wrote: > >> On 2019/3/4 22:11, Dmitry Vyukov wrote: > >>> On Mon, Mar 4, 2019 at 3:00 PM zhong jiang

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread zhong jiang
On 2019/3/5 14:26, Dmitry Vyukov wrote: > On Mon, Mar 4, 2019 at 4:32 PM zhong jiang wrote: >> On 2019/3/4 22:11, Dmitry Vyukov wrote: >>> On Mon, Mar 4, 2019 at 3:00 PM zhong jiang wrote: On 2019/3/4 15:40, Dmitry Vyukov wrote: > On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote:

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread Dmitry Vyukov
On Mon, Mar 4, 2019 at 4:32 PM zhong jiang wrote: > > On 2019/3/4 22:11, Dmitry Vyukov wrote: > > On Mon, Mar 4, 2019 at 3:00 PM zhong jiang wrote: > >> On 2019/3/4 15:40, Dmitry Vyukov wrote: > >>> On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote: > Hi, guys > > I also hit the

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread zhong jiang
On 2019/3/5 5:51, Matthew Wilcox wrote: > On Mon, Mar 04, 2019 at 12:19:32AM +0800, zhong jiang wrote: >> I also hit the following issue. but it fails to reproduce the issue by the >> log. >> >> it seems to the case that we access the mm->owner and deference it will >> result in the UAF. >> But

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread Matthew Wilcox
On Mon, Mar 04, 2019 at 12:19:32AM +0800, zhong jiang wrote: > I also hit the following issue. but it fails to reproduce the issue by the > log. > > it seems to the case that we access the mm->owner and deference it will > result in the UAF. > But it should not be possible that we specify the

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread zhong jiang
On 2019/3/4 22:11, Dmitry Vyukov wrote: > On Mon, Mar 4, 2019 at 3:00 PM zhong jiang wrote: >> On 2019/3/4 15:40, Dmitry Vyukov wrote: >>> On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote: Hi, guys I also hit the following issue. but it fails to reproduce the issue by the

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread Dmitry Vyukov
On Mon, Mar 4, 2019 at 3:00 PM zhong jiang wrote: > > On 2019/3/4 15:40, Dmitry Vyukov wrote: > > On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote: > >> Hi, guys > >> > >> I also hit the following issue. but it fails to reproduce the issue by the > >> log. > >> > >> it seems to the case that we

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-04 Thread zhong jiang
On 2019/3/4 15:40, Dmitry Vyukov wrote: > On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote: >> Hi, guys >> >> I also hit the following issue. but it fails to reproduce the issue by the >> log. >> >> it seems to the case that we access the mm->owner and deference it will >> result in the UAF. >>

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-03 Thread Dmitry Vyukov
On Sun, Mar 3, 2019 at 5:19 PM zhong jiang wrote: > > Hi, guys > > I also hit the following issue. but it fails to reproduce the issue by the > log. > > it seems to the case that we access the mm->owner and deference it will > result in the UAF. > But it should not be possible that we specify

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2019-03-03 Thread zhong jiang
Hi, guys I also hit the following issue. but it fails to reproduce the issue by the log. it seems to the case that we access the mm->owner and deference it will result in the UAF. But it should not be possible that we specify the incomplete process to be the mm->owner. Any thoughts? Thanks,

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2018-12-04 Thread syzbot
syzbot has found a reproducer for the following crash on: HEAD commit:0072a0c14d5b Merge tag 'media/v4.20-4' of git://git.kernel.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11c885a340 kernel config:

Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm

2018-12-04 Thread syzbot
syzbot has found a reproducer for the following crash on: HEAD commit:0072a0c14d5b Merge tag 'media/v4.20-4' of git://git.kernel.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11c885a340 kernel config:

KASAN: use-after-free Read in get_mem_cgroup_from_mm

2018-11-06 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:83650fd58a93 Merge tag 'arm64-upstream' of git://git.kerne.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12ce682b40 kernel config: https://syzkaller.appspot.com/x/.config?x=9384ecb1c973baed

KASAN: use-after-free Read in get_mem_cgroup_from_mm

2018-11-06 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:83650fd58a93 Merge tag 'arm64-upstream' of git://git.kerne.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12ce682b40 kernel config: https://syzkaller.appspot.com/x/.config?x=9384ecb1c973baed