Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-23 Thread Guillaume Nault
On Tue, May 22, 2018 at 08:29:58PM -0700, Eric Biggers wrote: > On Fri, May 18, 2018 at 06:02:23PM +0200, Guillaume Nault wrote: > > On Sun, May 13, 2018 at 11:11:55PM -0700, Eric Biggers wrote: > > > [+ppp list and maintainer] > > > > > > This is a bug in ppp_generic.c; it still happens on Linus'

Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-22 Thread Eric Biggers
On Fri, May 18, 2018 at 06:02:23PM +0200, Guillaume Nault wrote: > On Sun, May 13, 2018 at 11:11:55PM -0700, Eric Biggers wrote: > > [+ppp list and maintainer] > > > > This is a bug in ppp_generic.c; it still happens on Linus' tree and it's > > easily > > reproducible, see program below. The bug

Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-18 Thread Guillaume Nault
On Sun, May 13, 2018 at 11:11:55PM -0700, Eric Biggers wrote: > [+ppp list and maintainer] > > This is a bug in ppp_generic.c; it still happens on Linus' tree and it's > easily > reproducible, see program below. The bug is that the PPPIOCDETACH ioctl > doesn't > consider that the file can still

Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-13 Thread Eric Biggers
[+ppp list and maintainer] On Wed, Feb 28, 2018 at 08:59:02AM -0800, syzbot wrote: > Hello, > > syzbot hit the following crash on upstream commit > f3afe530d644488a074291da04a69a296ab63046 (Tue Feb 27 22:02:39 2018 +) > Merge branch 'fixes-v4.16-rc4' of > git://git.kernel.org/pub/scm/linux/ke