Re: net: use-after-free in tw_timer_handler

2017-02-21 Thread Dmitry Vyukov
On Tue, Feb 21, 2017 at 12:46 PM, Dmitry Vyukov wrote: > On Sat, Feb 18, 2017 at 1:30 AM, Cong Wang wrote: This code was changed a long time ago : https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d905

Re: net: use-after-free in tw_timer_handler

2017-02-21 Thread Dmitry Vyukov
On Sat, Feb 18, 2017 at 1:30 AM, Cong Wang wrote: >>> >>> This code was changed a long time ago : >>> >>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 >>> >>> So I suspect a recent patch broke the logic.

Re: net: use-after-free in tw_timer_handler

2017-02-17 Thread Cong Wang
On Fri, Feb 17, 2017 at 12:36 PM, Dmitry Vyukov wrote: > On Fri, Feb 17, 2017 at 7:51 PM, Cong Wang wrote: >> >> This code was changed a long time ago : >> >> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 >>

Re: net: use-after-free in tw_timer_handler

2017-02-17 Thread Dmitry Vyukov
On Fri, Feb 17, 2017 at 7:51 PM, Cong Wang wrote: > > This code was changed a long time ago : > > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 > > So I suspect a recent patch broke the logic. > >

Re: net: use-after-free in tw_timer_handler

2017-02-17 Thread Cong Wang
On Wed, Feb 8, 2017 at 9:36 AM, Dmitry Vyukov wrote: > On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: >> On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov wrote: This code was changed a long time ago : https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/

Re: net: use-after-free in tw_timer_handler

2017-02-14 Thread Dmitry Vyukov
On Wed, Feb 8, 2017 at 8:32 PM, Dmitry Vyukov wrote: >>> >> >>> This code was changed a long time ago : >>> >> >>> >>> >> >>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 >>> >> >>> >>> >> >>> So I suspect a recent patch broke

Re: net: use-after-free in tw_timer_handler

2017-02-08 Thread Dmitry Vyukov
On Wed, Feb 8, 2017 at 8:17 PM, Eric Dumazet wrote: > On Wed, 2017-02-08 at 19:55 +0100, Dmitry Vyukov wrote: >> On Wed, Feb 8, 2017 at 6:58 PM, Eric Dumazet wrote: >> > On Wed, 2017-02-08 at 18:36 +0100, Dmitry Vyukov wrote: >> >> On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: >> >> > On

Re: net: use-after-free in tw_timer_handler

2017-02-08 Thread Eric Dumazet
On Wed, 2017-02-08 at 19:55 +0100, Dmitry Vyukov wrote: > On Wed, Feb 8, 2017 at 6:58 PM, Eric Dumazet wrote: > > On Wed, 2017-02-08 at 18:36 +0100, Dmitry Vyukov wrote: > >> On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: > >> > On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov > >> > wrote:

Re: net: use-after-free in tw_timer_handler

2017-02-08 Thread Dmitry Vyukov
On Wed, Feb 8, 2017 at 6:58 PM, Eric Dumazet wrote: > On Wed, 2017-02-08 at 18:36 +0100, Dmitry Vyukov wrote: >> On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: >> > On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov wrote: >> >>> >> >>> This code was changed a long time ago : >> >>> >> >>> htt

Re: net: use-after-free in tw_timer_handler

2017-02-08 Thread Eric Dumazet
On Wed, 2017-02-08 at 18:36 +0100, Dmitry Vyukov wrote: > On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: > > On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov wrote: > >>> > >>> This code was changed a long time ago : > >>> > >>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/

Re: net: use-after-free in tw_timer_handler

2017-02-08 Thread Dmitry Vyukov
On Tue, Jan 24, 2017 at 4:52 PM, Eric Dumazet wrote: > On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov wrote: >>> >>> This code was changed a long time ago : >>> >>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 >>> >>> So I sus

Re: net: use-after-free in tw_timer_handler

2017-01-24 Thread Eric Dumazet
On Tue, Jan 24, 2017 at 7:06 AM, Dmitry Vyukov wrote: >> >> This code was changed a long time ago : >> >> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ed2e923945892a8372ab70d2f61d364b0b6d9054 >> >> So I suspect a recent patch broke the logic. >> >> You might start a b

Re: net: use-after-free in tw_timer_handler

2017-01-24 Thread Dmitry Vyukov
On Tue, Jan 24, 2017 at 3:28 PM, Eric Dumazet wrote: > On Mon, 2017-01-23 at 11:23 +0100, Dmitry Vyukov wrote: >> On Mon, Jan 23, 2017 at 11:19 AM, Dmitry Vyukov wrote: >> > Hello, >> > >> > While running syzkaller fuzzer I started seeing use-after-frees in >> > tw_timer_handler. It happens with

Re: net: use-after-free in tw_timer_handler

2017-01-24 Thread Eric Dumazet
On Mon, 2017-01-23 at 11:23 +0100, Dmitry Vyukov wrote: > On Mon, Jan 23, 2017 at 11:19 AM, Dmitry Vyukov wrote: > > Hello, > > > > While running syzkaller fuzzer I started seeing use-after-frees in > > tw_timer_handler. It happens with very low frequency, so far I've seen > > 22 of them. But all

Re: net: use-after-free in tw_timer_handler

2017-01-23 Thread Dmitry Vyukov
On Mon, Jan 23, 2017 at 11:19 AM, Dmitry Vyukov wrote: > Hello, > > While running syzkaller fuzzer I started seeing use-after-frees in > tw_timer_handler. It happens with very low frequency, so far I've seen > 22 of them. But all reports look consistent, so I would assume that it > is real, just r

net: use-after-free in tw_timer_handler

2017-01-23 Thread Dmitry Vyukov
Hello, While running syzkaller fuzzer I started seeing use-after-frees in tw_timer_handler. It happens with very low frequency, so far I've seen 22 of them. But all reports look consistent, so I would assume that it is real, just requires a very tricky race to happen. I've stared seeing it around