Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Eric Dumazet
On Mon, 2017-10-30 at 20:52 +0300, Dmitry Vyukov wrote: > syz fix: patch title > > then that's doable. If we agree on this format, then I am ready to > implement this. Yes please. David Miller and Linus never rebase their trees, for good reasons.

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Dmitry Vyukov
On Mon, Oct 30, 2017 at 8:47 PM, Eric Dumazet wrote: > On Mon, 2017-10-30 at 18:40 +0100, Dmitry Vyukov wrote: >> On Mon, Oct 30, 2017 at 6:30 PM, Eric Dumazet wrote: >> > On Mon, 2017-10-30 at 18:06 +0100, Dmitry Vyukov wrote: >> > >> >> Yes, but hashes in random trees also don't tell much. A tr

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Eric Dumazet
On Mon, 2017-10-30 at 18:40 +0100, Dmitry Vyukov wrote: > On Mon, Oct 30, 2017 at 6:30 PM, Eric Dumazet wrote: > > On Mon, 2017-10-30 at 18:06 +0100, Dmitry Vyukov wrote: > > > >> Yes, but hashes in random trees also don't tell much. A tree can be > >> rebased so the hash will be lost. It can be a

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread syzbot
On Mon, Oct 30, 2017 at 6:30 PM, Eric Dumazet wrote: On Mon, 2017-10-30 at 18:06 +0100, Dmitry Vyukov wrote: Yes, but hashes in random trees also don't tell much. A tree can be rebased so the hash will be lost. It can be a tree unknown to the system. Even if we find the commit by hash, in or

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Dmitry Vyukov
On Mon, Oct 30, 2017 at 6:30 PM, Eric Dumazet wrote: > On Mon, 2017-10-30 at 18:06 +0100, Dmitry Vyukov wrote: > >> Yes, but hashes in random trees also don't tell much. A tree can be >> rebased so the hash will be lost. It can be a tree unknown to the >> system. Even if we find the commit by hash

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Eric Dumazet
On Mon, 2017-10-30 at 18:06 +0100, Dmitry Vyukov wrote: > Yes, but hashes in random trees also don't tell much. A tree can be > rebased so the hash will be lost. It can be a tree unknown to the > system. Even if we find the commit by hash, in order to match it > against other trees we will have to

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Dmitry Vyukov
On Mon, Oct 30, 2017 at 5:36 PM, Eric Dumazet wrote: > On Mon, 2017-10-30 at 16:48 +0100, Dmitry Vyukov wrote: >> > >> > net-next tree : >> > >> > $ git log --oneline e7989f973ae1b90ec7c0b671c81.. -- drivers/net/tun.c >> > f8ddadc4db6c7b7029b6d0e0d9af24f74ad27ca2 Merge >> > git://git.kernel.org/p

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Eric Dumazet
On Mon, 2017-10-30 at 16:48 +0100, Dmitry Vyukov wrote: > > > > net-next tree : > > > > $ git log --oneline e7989f973ae1b90ec7c0b671c81.. -- drivers/net/tun.c > > f8ddadc4db6c7b7029b6d0e0d9af24f74ad27ca2 Merge > > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net > > ee74d9967b829232723939cb

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-30 Thread Dmitry Vyukov
On Sun, Oct 29, 2017 at 2:01 PM, Eric Dumazet wrote: > On Sun, 2017-10-29 at 13:45 +0100, Thomas Gleixner wrote: >> On Fri, 27 Oct 2017, syzbot wrote: >> >> Cc'ed network folks. >> >> > syzkaller hit the following crash on >> > e7989f973ae1b90ec7c0b671c81f7f553affccbe >> > git://git.kernel.org/pu

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-29 Thread Eric Dumazet
On Sun, 2017-10-29 at 13:45 +0100, Thomas Gleixner wrote: > On Fri, 27 Oct 2017, syzbot wrote: > > Cc'ed network folks. > > > syzkaller hit the following crash on > > e7989f973ae1b90ec7c0b671c81f7f553affccbe > > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > > compiler

Re: KASAN: use-after-free Write in detach_if_pending

2017-10-29 Thread Thomas Gleixner
On Fri, 27 Oct 2017, syzbot wrote: Cc'ed network folks. > syzkaller hit the following crash on e7989f973ae1b90ec7c0b671c81f7f553affccbe > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is atta