lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+YFMORo6YJBG_wOCFPK4dHHzQ_fBp650-E3REH8SdwpAQ@mail.gmail.com> Date: Tue, 28 Feb 2017 18:45:42 +0100 From: Dmitry Vyukov <dvyukov@...gle.com> To: Sowmini Varadhan <sowmini.varadhan@...cle.com> Cc: santosh.shilimkar@...cle.com, David Miller <davem@...emloft.net>, netdev <netdev@...r.kernel.org>, linux-rdma@...r.kernel.org, rds-devel@....oracle.com, LKML <linux-kernel@...r.kernel.org>, Eric Dumazet <edumazet@...gle.com>, syzkaller <syzkaller@...glegroups.com> Subject: Re: net/rds: use-after-free in inet_create On Tue, Feb 28, 2017 at 6:33 PM, Sowmini Varadhan <sowmini.varadhan@...cle.com> wrote: > On (02/28/17 17:51), Dmitry Vyukov wrote: >> Searching other crashes for "net/rds" I found 2 more crashes that may >> be related. They suggest that the delayed works are not properly >> stopped when the socket is destroyed. That would explain how >> rds_connect_worker accesses freed net, right? > > yes, I think we may want to explicitly cancel this workq.. this > in rds_conn_destroy(). > > I'm trying to build/sanity-test (if lucky, reproduce the bug) > as I send this out.. let me get back to you.. > > If I have a patch against net-next, would you be willing/able to > try it out? given that this does not show up on demand, I'm not > sure how we can check that "the fix worked".. Yes, I can now apply custom patches to the bots. However, it fired only 3 times, so it will give weak signal. But at least it will test that the patch does not cause other bad things.
Powered by blists - more mailing lists