From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754477AbcBVQhp (ORCPT ); Mon, 22 Feb 2016 11:37:45 -0500 Received: from mx1.redhat.com ([209.132.183.28]:40187 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752398AbcBVQhk (ORCPT ); Mon, 22 Feb 2016 11:37:40 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <1456157620-20819-1-git-send-email-jmarchan@redhat.com> References: <1456157620-20819-1-git-send-email-jmarchan@redhat.com> To: "Jerome Marchand" Cc: dhowells@redhat.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] assoc_array: don't call compare_object() on a node MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <12612.1456159058.1@warthog.procyon.org.uk> Date: Mon, 22 Feb 2016 16:37:38 +0000 Message-ID: <12613.1456159058@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Mon, 22 Feb 2016 16:37:39 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jerome Marchand wrote: > In assoc_array_insert_into_terminal_node(), we call the > compare_object() method on all empty slots, Ummm... That shouldn't happen - the: if (!ptr) { free_slot = i; continue; } preceding the line you modified should cause the comparison to be skipped on a slot if it's empty. > even when they're not leaves, passing a pointer to an unexpected structure > to compare_object(). Do you instead mean a metadata pointer rather than an empty slot? > Currently it causes an out-of-bound read access in keyring_compare_object > detected by KASan. The issue is easily reproduced with keyutils testsuite. I don't see it. Did you modify the testsuite, or is it a matter of running it often enough? Also, can you include the oops output you get in the patch description, please? That said, I can see that there is probably an issue that your patch fixes - but it's not quite the one you describe (see above). David