From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dominique Martinet Subject: Re: [PATCH] 9p: fix Use-After-Free in p9_write_work() Date: Mon, 30 Jul 2018 08:00:21 +0200 Message-ID: <20180730060021.GA22926@nautica> References: <20180729130248.29612-1-tomasbortoli@gmail.com> <20180729233336.GB28684@nautica> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Tomas Bortoli , David Miller , v9fs-developer@lists.sourceforge.net, netdev , LKML , syzkaller To: Dmitry Vyukov Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Dmitry Vyukov wrote on Mon, Jul 30, 2018: > On Mon, Jul 30, 2018 at 1:33 AM, Dominique Martinet > wrote: > > Tomas Bortoli wrote on Sun, Jul 29, 2018: > >> There is a race condition between p9_free_req() and p9_write_work(). > >> A request might still need to be processed while p9_free_req() is called. > >> > >> To fix it, flush the read/write work before freeing any request. > >> > >> Signed-off-by: Tomas Bortoli > >> Reported-by: syzbot+467050c1ce275af2a5b8@syzkaller.appspotmail.com > > > > It looks like I have not received this report, I found it through google > > in the lkml archives > > But you should have been received it? Or not? > We had some complaints that syzbot emails were not delivered, but in > these cases they were not delivered to lkml, and only to explicitly > CCed people. I'm not on lkml and the archives I found do not list who were Cc'd that I can see - it might have tried to send a copy to v9fs-developer that is held up in the moderation queue for all I know :/ I'm not complaining I didn't get a copy (if I ever find time to work on these, I can work through the list on the website) - I just need to know how to find the report corresponding to patchs being sent. > > but Dmitry do you have a convenient-ish way of > > finding the report on the syzkaller website with that reported-by tag? > > Well, you can do: > http://syzkaller.appspot.com/bug?extid=467050c1ce275af2a5b8 Thanks, for some reason I only thought of bug?id= which didn't work, this is perfect. Cheers, -- Dominique