Re: Use-after-free in ep_remove_wait_queue

2015-11-06 Thread Rainer Weikusat
Jason Baron writes: > On 11/06/2015 08:06 AM, Dmitry Vyukov wrote: >> On Mon, Oct 12, 2015 at 2:17 PM, Dmitry Vyukov wrote: >>> On Mon, Oct 12, 2015 at 2:14 PM, Eric Dumazet >>> wrote: On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote: > Probably the issue discussed in >

Re: Use-after-free in ep_remove_wait_queue

2015-11-06 Thread Jason Baron
On 11/06/2015 08:06 AM, Dmitry Vyukov wrote: > On Mon, Oct 12, 2015 at 2:17 PM, Dmitry Vyukov wrote: >> On Mon, Oct 12, 2015 at 2:14 PM, Eric Dumazet wrote: >>> On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote: >>> Probably the issue discussed in http://thread.gmane.org/gm

Re: Use-after-free in ep_remove_wait_queue

2015-11-06 Thread Dmitry Vyukov
On Mon, Oct 12, 2015 at 2:17 PM, Dmitry Vyukov wrote: > On Mon, Oct 12, 2015 at 2:14 PM, Eric Dumazet wrote: >> On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote: >> >>> Probably the issue discussed in >>> >>> http://thread.gmane.org/gmane.linux.kernel/2057497/ >>> >>> and previous relate

Re: Use-after-free in ep_remove_wait_queue

2015-10-12 Thread Dmitry Vyukov
On Mon, Oct 12, 2015 at 2:14 PM, Eric Dumazet wrote: > On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote: > >> Probably the issue discussed in >> >> http://thread.gmane.org/gmane.linux.kernel/2057497/ >> >> and previous related threads. >> > > Same issue, but Dmitry apparently did not trus

Re: Use-after-free in ep_remove_wait_queue

2015-10-12 Thread Eric Dumazet
On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote: > Probably the issue discussed in > > http://thread.gmane.org/gmane.linux.kernel/2057497/ > > and previous related threads. > Same issue, but Dmitry apparently did not trust me. -- To unsubscribe from this list: send the line "unsubs

Re: Use-after-free in ep_remove_wait_queue

2015-10-12 Thread Michal Kubecek
On Mon, Oct 12, 2015 at 01:07:55PM +0200, Dmitry Vyukov wrote: > Hello, > > The following program causes use-after-in kernel: > ... > long r0 = syscall(SYS_mmap, 0x20001000ul, 0x1000ul, 0x3ul, > 0x32ul, 0xul, 0x0ul); > long r1 = syscall(SYS_mmap, 0x2000ul, 0x10