From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752012AbdCMKDB (ORCPT ); Mon, 13 Mar 2017 06:03:01 -0400 Received: from Galois.linutronix.de ([146.0.238.70]:36158 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751334AbdCMKCn (ORCPT ); Mon, 13 Mar 2017 06:02:43 -0400 Date: Mon, 13 Mar 2017 11:02:34 +0100 From: Sebastian Andrzej Siewior To: Peter Zijlstra Cc: Dmitry Vyukov , Thomas Gleixner , Davidlohr Bueso , Ingo Molnar , LKML , syzkaller Subject: Re: futex: use-after-free in futex_wait_requeue_pi Message-ID: <20170313100233.fgbocbi7uwywmofj@linutronix.de> References: <20170313080620.GG3343@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170313080620.GG3343@twins.programming.kicks-ass.net> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017-03-13 09:06:20 [+0100], Peter Zijlstra wrote: > On Fri, Mar 10, 2017 at 07:10:30PM +0100, Dmitry Vyukov wrote: > > The following program triggers use-after-free in futex_wait_requeue_pi: > > https://gist.githubusercontent.com/dvyukov/42e596153263793b75ad587c8d0626b0/raw/35461a6c1b0a4163a67191ff5d35202f35ecbf44/gistfile1.txt > There's a known use-after-free there, see: > I've not woken up enough; or actually looked at your report to see if > its the same. It seems so, yes. The test-case triggered on the commit mentioned in less than a minute and after the patch applied it runs now for 16 without complains. A stable tag would be nice then :) Sebastian