From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Ricardo Leitner Date: Thu, 03 Dec 2015 16:15:13 +0000 Subject: Re: use-after-free in sctp_do_sm Message-Id: <20151203161513.GC4164@mrl.redhat.com> List-Id: References: <20151203130525.GB4164@mrl.redhat.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dmitry Vyukov Cc: Eric Dumazet , syzkaller , Vladislav Yasevich , linux-sctp@vger.kernel.org, netdev , Kostya Serebryany , Alexander Potapenko , Sasha Levin On Thu, Dec 03, 2015 at 04:55:44PM +0100, Dmitry Vyukov wrote: > On Thu, Dec 3, 2015 at 3:48 PM, Eric Dumazet wrote: > >> > >> No, I don't. But pr_debug always computes its arguments. See no_printk > >> in printk.h. So this use-after-free happens for all users. > > > > Hmm. > > > > pr_debug() should be a nop unless either DEBUG or CONFIG_DYNAMIC_DEBUG are set > > > > On our production kernels, pr_debug() is a nop. > > > > Can you double check ? Thanks ! > > > Why should it be nop? no_printk thing in printk.h pretty much > explicitly makes it not a nop... > > Double-checked: debug_post_sfx leads to some generated code: Oups. I was under that impression too, that it would do sanity-check while being optimized out. I'll think on a fix for this. Thanks, Marcelo From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Ricardo Leitner Subject: Re: use-after-free in sctp_do_sm Date: Thu, 3 Dec 2015 14:15:13 -0200 Message-ID: <20151203161513.GC4164@mrl.redhat.com> References: <20151203130525.GB4164@mrl.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Eric Dumazet , syzkaller , Vladislav Yasevich , linux-sctp@vger.kernel.org, netdev , Kostya Serebryany , Alexander Potapenko , Sasha Levin To: Dmitry Vyukov Return-path: Received: from mx1.redhat.com ([209.132.183.28]:33497 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757175AbbLCQPR (ORCPT ); Thu, 3 Dec 2015 11:15:17 -0500 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Thu, Dec 03, 2015 at 04:55:44PM +0100, Dmitry Vyukov wrote: > On Thu, Dec 3, 2015 at 3:48 PM, Eric Dumazet wrote: > >> > >> No, I don't. But pr_debug always computes its arguments. See no_printk > >> in printk.h. So this use-after-free happens for all users. > > > > Hmm. > > > > pr_debug() should be a nop unless either DEBUG or CONFIG_DYNAMIC_DEBUG are set > > > > On our production kernels, pr_debug() is a nop. > > > > Can you double check ? Thanks ! > > > Why should it be nop? no_printk thing in printk.h pretty much > explicitly makes it not a nop... > > Double-checked: debug_post_sfx leads to some generated code: Oups. I was under that impression too, that it would do sanity-check while being optimized out. I'll think on a fix for this. Thanks, Marcelo