From: Jason Gunthorpe <jgg@ziepe.ca>
To: Eric Biggers <ebiggers@kernel.org>
Cc: Doug Ledford <dledford@redhat.com>,
linux-rdma@vger.kernel.org,
dasaratharaman.chandramouli@intel.com, leonro@mellanox.com,
linux-kernel@vger.kernel.org, markb@mellanox.com,
monis@mellanox.com, parav@mellanox.com,
syzkaller-bugs@googlegroups.com,
syzbot <syzbot+29ee8f76017ce6cf03da@syzkaller.appspotmail.com>
Subject: Re: [RDMA bug] KASAN: use-after-free Read in __list_del_entry_valid (4)
Date: Thu, 23 Aug 2018 08:54:58 -0600 [thread overview]
Message-ID: <20180823145458.GC9366@ziepe.ca> (raw)
In-Reply-To: <20180823061630.GB736@sol.localdomain>
On Wed, Aug 22, 2018 at 11:16:31PM -0700, Eric Biggers wrote:
> Hello RDMA / InfiniBand maintainers,
>
> This is an RDMA bug and it still occurs on Linus' tree as of today
> (commit 815f0ddb346c1960).
>
> I've also simplified the reproducer for it; see below after the original report.
> Apparently it involves a race between RDMA_USER_CM_CMD_RESOLVE_IP and
> RDMA_USER_CM_CMD_LISTEN.
That is an amazing reproducer!
I have a feeling this is the same cause as all the other syzkaller
bugs in this code: lack of any sane locking at all :\
We've talked about chucking a big lock around this whole thing, but
nobody has done it yet.. It isn't so simple.
Jason
next prev parent reply other threads:[~2018-08-23 14:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-26 0:01 KASAN: use-after-free Read in __list_del_entry_valid (4) syzbot
2018-03-26 3:43 ` syzbot
2018-08-23 6:16 ` [RDMA bug] " Eric Biggers
2018-08-23 14:54 ` Jason Gunthorpe [this message]
2018-08-23 16:39 ` Parav Pandit
2018-08-23 16:55 ` Doug Ledford
2018-08-23 17:14 ` Parav Pandit
2018-08-23 17:17 ` Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180823145458.GC9366@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=dasaratharaman.chandramouli@intel.com \
--cc=dledford@redhat.com \
--cc=ebiggers@kernel.org \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=markb@mellanox.com \
--cc=monis@mellanox.com \
--cc=parav@mellanox.com \
--cc=syzbot+29ee8f76017ce6cf03da@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.