From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sowmini Varadhan Subject: Re: [PATCH] rds: fix use-after-free read in rds_find_bound Date: Sat, 30 Dec 2017 15:26:31 -0500 Message-ID: <20171230202631.GB27855@oracle.com> References: <1514662599-14491-1-git-send-email-santosh.shilimkar@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, davem@davemloft.net To: Santosh Shilimkar Return-path: Received: from userp2130.oracle.com ([156.151.31.86]:46493 "EHLO userp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750828AbdL3U0j (ORCPT ); Sat, 30 Dec 2017 15:26:39 -0500 Content-Disposition: inline In-Reply-To: <1514662599-14491-1-git-send-email-santosh.shilimkar@oracle.com> Sender: netdev-owner@vger.kernel.org List-ID: On (12/30/17 11:36), Santosh Shilimkar wrote: > > socket buffer can get freed as part of sock_close > callback so before adding reference check underneath > socket validity. I'm not sure I understand this fix- struct rds_sock is: struct rds_sock { struct sock rs_sk; : } How can rs be non-null but rds_rs_to_sk() is null? (Note that rds_rs_to_sk just returns &rs->rs_sk) so the changed line is identical to the original line. > - if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) > + if (rs && rds_rs_to_sk(rs) && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) I think the real issue is refcount bug somewhere, Was the syzbot test run with http://patchwork.ozlabs.org/patch/852492/ this sounds like that type of bug. --Sowmini