From: Sasha Levin <sasha.levin@oracle.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: ast@kernel.org, "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>, Tejun Heo <tj@kernel.org>
Subject: Re: bpf: use-after-free in array_map_alloc
Date: Sun, 17 Apr 2016 18:45:44 -0400 [thread overview]
Message-ID: <57141218.4000103@oracle.com> (raw)
In-Reply-To: <20160417172943.GA83672@ast-mbp.thefacebook.com>
On 04/17/2016 01:29 PM, Alexei Starovoitov wrote:
> On Sun, Apr 17, 2016 at 12:58:21PM -0400, Sasha Levin wrote:
>> > Hi all,
>> >
>> > I've hit the following while fuzzing with syzkaller inside a KVM tools guest
>> > running the latest -next kernel:
> thanks for the report. Adding Tejun...
> if I read the report correctly it's not about bpf, but rather points to
> the issue inside percpu logic.
> First __alloc_percpu_gfp() is called, then the memory is freed with
> free_percpu() which triggers async pcpu_balance_work and then
> pcpu_extend_area_map is hitting use-after-free.
> I guess bpf percpu array map is stressing this logic the most.
> Any simpler steps to reproduce ?
No simple way to reproduce. I blamed bpf because I saw a few traces
and it was only bpf that was causing it, there was no other reasoning
behind it.
Thanks,
Sasha
next prev parent reply other threads:[~2016-04-17 22:45 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-17 16:58 bpf: use-after-free in array_map_alloc Sasha Levin
2016-04-17 17:29 ` Alexei Starovoitov
2016-04-17 22:45 ` Sasha Levin [this message]
2016-05-23 12:01 ` Vlastimil Babka
2016-05-23 12:01 ` Vlastimil Babka
2016-05-23 12:07 ` Vlastimil Babka
2016-05-23 12:07 ` Vlastimil Babka
2016-05-23 21:35 ` Tejun Heo
2016-05-23 21:35 ` Tejun Heo
2016-05-23 22:13 ` Alexei Starovoitov
2016-05-23 22:13 ` Alexei Starovoitov
2016-05-24 8:40 ` Vlastimil Babka
2016-05-24 8:40 ` Vlastimil Babka
2016-05-24 15:30 ` Tejun Heo
2016-05-24 15:30 ` Tejun Heo
2016-05-24 19:04 ` Tejun Heo
2016-05-24 19:04 ` Tejun Heo
2016-05-24 20:43 ` Alexei Starovoitov
2016-05-24 20:43 ` Alexei Starovoitov
2016-05-25 15:44 ` [PATCH percpu/for-4.7-fixes 1/2] percpu: fix synchronization between chunk->map_extend_work and chunk destruction Tejun Heo
2016-05-25 15:44 ` Tejun Heo
2016-05-26 9:19 ` Vlastimil Babka
2016-05-26 9:19 ` Vlastimil Babka
2016-05-26 19:21 ` Tejun Heo
2016-05-26 19:21 ` Tejun Heo
2016-05-26 20:48 ` Vlastimil Babka
2016-05-26 20:48 ` Vlastimil Babka
2016-05-25 15:45 ` [PATCH percpu/for-4.7-fixes 2/2] percpu: fix synchronization between synchronous map extension " Tejun Heo
2016-05-25 15:45 ` Tejun Heo
2016-05-26 9:48 ` Vlastimil Babka
2016-05-26 9:48 ` Vlastimil Babka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=57141218.4000103@oracle.com \
--to=sasha.levin@oracle.com \
--cc=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.