Re: KASAN: use-after-free Read in rds_tcp_dev_event

2018-02-13 Thread Dmitry Vyukov
On Tue, Nov 14, 2017 at 4:30 AM, Girish Moodalbail wrote: > On 11/7/17 12:28 PM, syzbot wrote: >> >> Hello, >> >> syzkaller hit the following crash on >> 287683d027a3ff83feb6c7044430c79881664ecf >> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master >> compiler: gcc (GCC) 7.1.1

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Girish Moodalbail
On 11/14/17 5:22 AM, Sowmini Varadhan wrote: A few questions. - First off, why am I not seeing the original mail in this thread even when I search the mail archives, e.g., https://lkml.org/lkml/2017/11/13/954 - Girish Moodalbail writes: The issue here is that we are trying to refer

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Dmitry Vyukov
s, e.g., >> https://lkml.org/lkml/2017/11/13/954 > > > Good question! > > The original message was sent to 4 kernel mailing lists: > > -- Forwarded message -- > From: syzbot > > Date: Tue, Nov 7, 2017 at 9:28 PM > Subject: KASAN: use-after

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Dmitry Vyukov
message was sent to 4 kernel mailing lists: -- Forwarded message -- From: syzbot Date: Tue, Nov 7, 2017 at 9:28 PM Subject: KASAN: use-after-free Read in rds_tcp_dev_event To: davem@, linux-ker...@vger.kernel.org, linux-r...@vger.kernel.org, netdev@vger.kernel.org, rds

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Sowmini Varadhan
A few questions. - First off, why am I not seeing the original mail in this thread even when I search the mail archives, e.g., https://lkml.org/lkml/2017/11/13/954 - Girish Moodalbail writes: > The issue here is that we are trying to reference a network namespace > (struct net *) that

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-13 Thread Sowmini Varadhan
On (11/13/17 19:30), Girish Moodalbail wrote: > (L538-540). However, it leaves behind some of the rds_tcp connections that > shared the same underlying RDS connection (L534 and 535). These connections > with pointer to stale network namespace are left behind in the global list. It leaves behind no

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-13 Thread Girish Moodalbail
On 11/7/17 12:28 PM, syzbot wrote: Hello, syzkaller hit the following crash on 287683d027a3ff83feb6c7044430c79881664ecf git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master compiler: gcc (GCC) 7.1.1 20170620 .config is attached Raw console output is attached. =