Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-08-22 Thread Eric Biggers
On Sat, May 26, 2018 at 11:24:01AM +0200, Dmitry Vyukov wrote: > On Sun, May 13, 2018 at 8:21 AM, Eric Biggers wrote: > > On Thu, Apr 05, 2018 at 08:15:24PM -0700, Eric Biggers wrote: > >> On Mon, Jan 29, 2018 at 01:29:48PM +0800, Tianyu Lan wrote: > >> > > >> > > >> > On 1/27/2018 7:27 AM, Eric B

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-05-26 Thread Dmitry Vyukov
On Sun, May 13, 2018 at 8:21 AM, Eric Biggers wrote: > On Thu, Apr 05, 2018 at 08:15:24PM -0700, Eric Biggers wrote: >> On Mon, Jan 29, 2018 at 01:29:48PM +0800, Tianyu Lan wrote: >> > >> > >> > On 1/27/2018 7:27 AM, Eric Biggers wrote: >> > > On Sat, Dec 16, 2017 at 04:37:02PM +0800, Lan, Tianyu

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-05-12 Thread Eric Biggers
On Thu, Apr 05, 2018 at 08:15:24PM -0700, Eric Biggers wrote: > On Mon, Jan 29, 2018 at 01:29:48PM +0800, Tianyu Lan wrote: > > > > > > On 1/27/2018 7:27 AM, Eric Biggers wrote: > > > On Sat, Dec 16, 2017 at 04:37:02PM +0800, Lan, Tianyu wrote: > > > > The root cause is that kvm_irqfd_assign() an

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-04-05 Thread Eric Biggers
On Mon, Jan 29, 2018 at 01:29:48PM +0800, Tianyu Lan wrote: > > > On 1/27/2018 7:27 AM, Eric Biggers wrote: > > On Sat, Dec 16, 2017 at 04:37:02PM +0800, Lan, Tianyu wrote: > > > The root cause is that kvm_irqfd_assign() and kvm_irqfd_deassign() can't > > > be run in parallel. Some data structure

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-01-28 Thread Tianyu Lan
On 1/27/2018 7:27 AM, Eric Biggers wrote: On Sat, Dec 16, 2017 at 04:37:02PM +0800, Lan, Tianyu wrote: The root cause is that kvm_irqfd_assign() and kvm_irqfd_deassign() can't be run in parallel. Some data structure(e.g, irqfd->consumer) will be crashed because irqfd may be freed in deassign p

Re: Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2018-01-26 Thread Eric Biggers
On Sat, Dec 16, 2017 at 04:37:02PM +0800, Lan, Tianyu wrote: > The root cause is that kvm_irqfd_assign() and kvm_irqfd_deassign() can't > be run in parallel. Some data structure(e.g, irqfd->consumer) will be > crashed because irqfd may be freed in deassign path before they are used > in assign path

Re: Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2017-12-16 Thread Lan, Tianyu
The root cause is that kvm_irqfd_assign() and kvm_irqfd_deassign() can't be run in parallel. Some data structure(e.g, irqfd->consumer) will be crashed because irqfd may be freed in deassign path before they are used in assign path. The other data maybe used in deassign path before initialization.

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2017-12-15 Thread Tianyu Lan
I reproduced the issue. Will have a look. -- Best regards Tianyu Lan 2017-12-15 18:14 GMT+08:00 syzbot : > syzkaller has found reproducer for the following crash on > 82bcf1def3b5f1251177ad47c44f7e17af039b4b > git://git.cmpxchg.org/linux-mmots.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .c

Re: KASAN: use-after-free Write in irq_bypass_register_consumer

2017-10-30 Thread Dmitry Vyukov
On Mon, Oct 30, 2017 at 10:12 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > cd4175b11685b11c40e31a03e05084cc212b0649 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is