Re: use-after-free access in bt_iter()

[pragalla@codeaurora.org]

On 2021-02-04 21:47, John Garry wrote:
> On 04/02/2021 15:51, Bart Van Assche wrote:
>> On 2/4/21 3:46 AM,pragalla@codeaurora.org  wrote:
>>> Is this issue got fixed on any latest kernel ? if so, can you please
>>> help point the patch ?
>>> If not got fixed, can we have a final solution ? i can even help in
>>> testing the solution.
>> Hi John,
>> 
> 
> Hi Bart,
> 
>> Some time ago you replied the following to an email from me with a
>> suggestion for a fix: "Please let me consider it a bit more." Are you
>> still working on a fix?
> 
> Unfortunately I have not had a chance, sorry. But I can look again.
> 
> So I have only seen KASAN use-after-free's myself, but never an actual
> oops. IIRC, someone did report an oops.
> 
Hi John,

> @Pradeep, do you have a reliable re-creator? I noticed the timeout
> handler stackframe in your mail, so I guess not. However, as an
> experiment, could you test:
> https://lore.kernel.org/linux-block/1608203273-170555-2-git-send-email-john.garry@huawei.com/
> 
Yes, i don't have a reliable re-creator. The oops was noticed as a part 
of stability testing and
was not an intentional try. This was noticed couple of times.
Please share the steps (if any) to easy hit or to exercise this path 
more frequently.
Meanwhile, i will go with the usual stability procedure. i will update 
the results here later.

> This should fix the common issue. But no final solution to issues
> discussed from patch 2/2, which is more exotic.
> 
> BTW, is this the same Pradeep who reported:
> https://lore.kernel.org/linux-block/1606402925-24420-1-git-send-email-ppvk@codeaurora.org/
> 
> I did cc ppvk@codeaurora.org on earlier version of my series, but it 
> bounced.
> 
Yes, it's the same Pradeep. Unfortunately my old email 
"ppvk@codeaurora.org" got expired and
couldn't able to restore. Hence the bounced emails. Now this got 
resolved with a new email
"pragalla@codeaurora.org" which I'm now currently replying.

>> 
>> See also
>> https://lore.kernel.org/linux-block/1bcc1d9e-6a32-1e00-0d32-f5b7325b2f8c@huawei.com/
> 
> Thanks,
> John

Thanks and Regards,
Pradeep