From: Florian Westphal <fw@strlen.de>
To: Pavel Skripkin <paskripkin@gmail.com>
Cc: Florian Westphal <fw@strlen.de>,
syzbot <syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com>,
coreteam@netfilter.org, davem@davemloft.net,
kadlec@netfilter.org, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org, pablo@netfilter.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu
Date: Mon, 9 Aug 2021 23:40:27 +0200 [thread overview]
Message-ID: <20210809214027.GQ607@breakpoint.cc> (raw)
In-Reply-To: <2d002841-402c-2bc3-2b33-3e6d1cd14c23@gmail.com>
Pavel Skripkin <paskripkin@gmail.com> wrote:
> Dumb question: why per_cpu() will return 2 different pointers for CPU 1 and
> CPU 0? As I understand for_each_possible_cpu() will iterate over all
> CPUs which could ever be enabled. So, we can hit situation when 2 concurrent
> processes call per_cpu() with same cpu value (*).
Yes, that is what I was trying to say, the race is that we can have > 1
processes here ever since the global transaction mutex was removed in 2018.
> Anyway, I think, moving locking a bit higher is good here, let's test it. I
> will prepare a patch, if it will pass syzbot testing, thanks!
It looks correct to me, thanks.
next prev parent reply other threads:[~2021-08-09 21:40 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-07 13:44 [syzbot] KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu syzbot
2021-08-07 20:50 ` syzbot
2021-08-09 19:22 ` Pavel Skripkin
2021-08-09 20:39 ` Florian Westphal
2021-08-09 21:16 ` Pavel Skripkin
2021-08-09 21:40 ` Florian Westphal [this message]
2021-08-10 3:18 ` syzbot
2021-08-10 2:59 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210809214027.GQ607@breakpoint.cc \
--to=fw@strlen.de \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=paskripkin@gmail.com \
--cc=syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.