Re: KASAN: use-after-free Read in rds_tcp_dev_event

2018-02-13 Thread Dmitry Vyukov
On Tue, Nov 14, 2017 at 4:30 AM, Girish Moodalbail wrote: > On 11/7/17 12:28 PM, syzbot wrote: >> >> Hello, >> >> syzkaller hit the following crash on >> 287683d027a3ff83feb6c7044430c79881664ecf >> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master >> compiler: gcc (GCC) 7.1.1

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Girish Moodalbail
On 11/14/17 5:22 AM, Sowmini Varadhan wrote: A few questions. - First off, why am I not seeing the original mail in this thread even when I search the mail archives, e.g., https://lkml.org/lkml/2017/11/13/954 - Girish Moodalbail writes: The issue here is that we are trying to refer

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Dmitry Vyukov
On Tue, Nov 14, 2017 at 3:04 PM, Dmitry Vyukov wrote: > On Tue, Nov 14, 2017 at 2:22 PM, Sowmini Varadhan > wrote: >> >> >> A few questions. >> >> - First off, why am I not seeing the original mail in this thread >> even when I search the mail archives, e.g., >> https://lkml.org/lkml/2017/1

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Dmitry Vyukov
On Tue, Nov 14, 2017 at 2:22 PM, Sowmini Varadhan wrote: > > > A few questions. > > - First off, why am I not seeing the original mail in this thread > even when I search the mail archives, e.g., > https://lkml.org/lkml/2017/11/13/954 Good question! The original message was sent to 4 kern

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-14 Thread Sowmini Varadhan
A few questions. - First off, why am I not seeing the original mail in this thread even when I search the mail archives, e.g., https://lkml.org/lkml/2017/11/13/954 - Girish Moodalbail writes: > The issue here is that we are trying to reference a network namespace > (struct net *) that

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-13 Thread Sowmini Varadhan
On (11/13/17 19:30), Girish Moodalbail wrote: > (L538-540). However, it leaves behind some of the rds_tcp connections that > shared the same underlying RDS connection (L534 and 535). These connections > with pointer to stale network namespace are left behind in the global list. It leaves behind no

Re: KASAN: use-after-free Read in rds_tcp_dev_event

2017-11-13 Thread Girish Moodalbail
On 11/7/17 12:28 PM, syzbot wrote: Hello, syzkaller hit the following crash on 287683d027a3ff83feb6c7044430c79881664ecf git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master compiler: gcc (GCC) 7.1.1 20170620 .config is attached Raw console output is attached. =