Re: net/rds: use-after-free in inet_create

2017-03-01 Thread Dmitry Vyukov
On Tue, Feb 28, 2017 at 11:24 PM, Sowmini Varadhan wrote: > > Actually, I'm not sure if I can assert that these are all manifestations > of the same bug- was a netns-delete involved in this one as well? > > I see: > >> BUG: KASAN: use-after-free in memcmp+0xe3/0x160 lib/string.c:768 at > : >>

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
Actually, I'm not sure if I can assert that these are all manifestations of the same bug- was a netns-delete involved in this one as well? I see: > BUG: KASAN: use-after-free in memcmp+0xe3/0x160 lib/string.c:768 at : > memcmp+0xe3/0x160 lib/string.c:768 : > rds_find_bound+0x4fe/0x8a0

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (03/01/17 00:14), Dmitry Vyukov wrote: > > But the other 2 use-after-frees happened on cp->cp_send_w. Shouldn't > we cancel it as well? And cp_recv_w? yes, good point, I missed that. let me see if I can refactor the code to release the netns as the last thing before free..

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
On Wed, Mar 1, 2017 at 12:06 AM, Sowmini Varadhan wrote: > Just posted an RFC patch, that I'm also testing here.. > hopefully we'll se the pr_info light up, and know that the problematic > situation actually happened (I'll remove the pr_info if/when this > gets submitted as a non-RFC patch).. than

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
Just posted an RFC patch, that I'm also testing here.. hopefully we'll se the pr_info light up, and know that the problematic situation actually happened (I'll remove the pr_info if/when this gets submitted as a non-RFC patch).. thanks for helping with testing this.. --Sowmini

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
On Tue, Feb 28, 2017 at 6:33 PM, Sowmini Varadhan wrote: > On (02/28/17 17:51), Dmitry Vyukov wrote: >> Searching other crashes for "net/rds" I found 2 more crashes that may >> be related. They suggest that the delayed works are not properly >> stopped when the socket is destroyed. That would expl

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (02/28/17 18:45), Dmitry Vyukov wrote: > > Yes, I can now apply custom patches to the bots. However, it fired > only 3 times, so it will give weak signal. But at least it will test > that the patch does not cause other bad things. Ok, let me do my bit of homework on this one and get back to yo

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (02/28/17 17:51), Dmitry Vyukov wrote: > Searching other crashes for "net/rds" I found 2 more crashes that may > be related. They suggest that the delayed works are not properly > stopped when the socket is destroyed. That would explain how > rds_connect_worker accesses freed net, right? yes, I

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
On Tue, Feb 28, 2017 at 5:38 PM, Sowmini Varadhan wrote: > On (02/28/17 17:32), Dmitry Vyukov wrote: >> Not reproducible so far. >> >> rds is compiled into kernel (no modules): >> CONFIG_RDS=y >> CONFIG_RDS_TCP=y > > I see. So if it never gets unloaded, the rds_connections "should" > be around for

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (02/28/17 17:32), Dmitry Vyukov wrote: > Not reproducible so far. > > rds is compiled into kernel (no modules): > CONFIG_RDS=y > CONFIG_RDS_TCP=y I see. So if it never gets unloaded, the rds_connections "should" be around forever.. let me inspect code and see if I spot some race-window.. >

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
On Tue, Feb 28, 2017 at 5:15 PM, Sowmini Varadhan wrote: > On (02/28/17 16:49), Dmitry Vyukov wrote: >> >> Grepping "socket" there, it was doing lots of things with sockets. Are >> we looking for some particular socket type? If there are few programs >> that create sockets of that type, then we ca

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (02/28/17 16:49), Dmitry Vyukov wrote: > > Grepping "socket" there, it was doing lots of things with sockets. Are > we looking for some particular socket type? If there are few programs > that create sockets of that type, then we can narrow down the set: Yes, we are looking for PF_RDS/AF_RDS -

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
On Tue, Feb 28, 2017 at 4:37 PM, Sowmini Varadhan wrote: > On (02/28/17 15:22), Dmitry Vyukov wrote: >> >> Hello, >> >> I've got the following report while running syzkaller fuzzer on >> linux-next/8d01c069486aca75b8f6018a759215b0ed0c91f0. So far it >> happened only once. net was somehow deleted f

Re: net/rds: use-after-free in inet_create

2017-02-28 Thread Sowmini Varadhan
On (02/28/17 15:22), Dmitry Vyukov wrote: > > Hello, > > I've got the following report while running syzkaller fuzzer on > linux-next/8d01c069486aca75b8f6018a759215b0ed0c91f0. So far it > happened only once. net was somehow deleted from underneath > inet_create. I've noticed that rds uses sock_cr

net/rds: use-after-free in inet_create

2017-02-28 Thread Dmitry Vyukov
Hello, I've got the following report while running syzkaller fuzzer on linux-next/8d01c069486aca75b8f6018a759215b0ed0c91f0. So far it happened only once. net was somehow deleted from underneath inet_create. I've noticed that rds uses sock_create_kern which does not take net reference. What is that