linux-kernel - Re: [RDMA bug] KASAN: use-after-free Read in __list_del_entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180823145458.GC9366@ziepe.ca>
Date:   Thu, 23 Aug 2018 08:54:58 -0600
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Eric Biggers <ebiggers@...nel.org>
Cc:     Doug Ledford <dledford@...hat.com>, linux-rdma@...r.kernel.org,
        dasaratharaman.chandramouli@...el.com, leonro@...lanox.com,
        linux-kernel@...r.kernel.org, markb@...lanox.com,
        monis@...lanox.com, parav@...lanox.com,
        syzkaller-bugs@...glegroups.com,
        syzbot <syzbot+29ee8f76017ce6cf03da@...kaller.appspotmail.com>
Subject: Re: [RDMA bug] KASAN: use-after-free Read in __list_del_entry_valid
 (4)

On Wed, Aug 22, 2018 at 11:16:31PM -0700, Eric Biggers wrote:
> Hello RDMA / InfiniBand maintainers,
> 
> This is an RDMA bug and it still occurs on Linus' tree as of today
> (commit 815f0ddb346c1960).
> 
> I've also simplified the reproducer for it; see below after the original report.
> Apparently it involves a race between RDMA_USER_CM_CMD_RESOLVE_IP and
> RDMA_USER_CM_CMD_LISTEN.

That is an amazing reproducer!

I have a feeling this is the same cause as all the other syzkaller
bugs in this code: lack of any sane locking at all :\

We've talked about chucking a big lock around this whole thing, but
nobody has done it yet.. It isn't so simple.

Jason