linux-kernel - Re: KASAN: use-after-free Read in alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180403031021.GB685@sol.localdomain>
Date:   Mon, 2 Apr 2018 20:10:21 -0700
From:   Eric Biggers <ebiggers3@...il.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     syzbot <syzbot+7a1cff37dbbef9e7ba4c@...kaller.appspotmail.com>,
        akpm@...ux-foundation.org, dhowells@...hat.com, gs051095@...il.com,
        linux-kernel@...r.kernel.org, oleg@...hat.com,
        pasha.tatashin@...cle.com, riel@...hat.com,
        rppt@...ux.vnet.ibm.com, syzkaller-bugs@...glegroups.com,
        wangkefeng.wang@...wei.com
Subject: Re: KASAN: use-after-free Read in alloc_pid

On Mon, Apr 02, 2018 at 06:00:57PM -0500, Eric W. Biederman wrote:
> syzbot <syzbot+7a1cff37dbbef9e7ba4c@...kaller.appspotmail.com> writes:
> 
> > Hello,
> >
> > syzbot hit the following crash on upstream commit
> > 9dd2326890d89a5179967c947dab2bab34d7ddee (Fri Mar 30 17:29:47 2018 +0000)
> > Merge tag 'ceph-for-4.16-rc8' of git://github.com/ceph/ceph-client
> > syzbot dashboard link:
> > https://syzkaller.appspot.com/bug?extid=7a1cff37dbbef9e7ba4c
> >
> > So far this crash happened 4 times on upstream.
> >
> > Unfortunately, I don't have any reproducer for this crash yet.
> 
> Do you have any of the other traces?  This looks like a something is
> calling put_pid_ns more than it is calling get_pid_ns causing a
> reference count mismatch.
> 
> If this is not: 9ee332d99e4d5a97548943b81c54668450ce641b
> 
> I could use a few more hints to help narrow down what is going wrong.
> 
> It would be nice to know what the other 3 crashes looked like and
> exactly which upstream they were on.
> 

The other crashes are shown on the syzbot dashboard (link was given in the
original email).

Eric