From: Shankara Pailoor <sp3485@columbia.edu>
To: LKML <linux-kernel@vger.kernel.org>,
viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org
Subject: Re: KASAN: use-after-free in move_expired_inodes
Date: Tue, 31 Oct 2017 22:04:49 -0400 [thread overview]
Message-ID: <CAASgV=uFkfFg3HeG_GnHWbCc=-OFq6nqH7bDKQt2HymdD+wiDA@mail.gmail.com> (raw)
In-Reply-To: <CAASgV=tSiiiXgCzuk03AyvrLS72zJxzF1rL4JkFgLnxBDzqhug@mail.gmail.com>
Hi Al, etc,
I was unable to find a reproducer but I was looking at
move_expired_inodes (fs/fs-writeback.c 1093.c) and how do you ensure
that the inode can't be freed after retrieving it from the work queue?
Any insights would be appreciated.
Regards,
Shankara
On Tue, Oct 31, 2017 at 9:24 AM, Shankara Pailoor <sp3485@columbia.edu> wrote:
> Hi,
>
> We got the following error:
>
> BUG: KASAN: use-after-free in move_expired_inodes+0xce6/0xdf0
> Write of size 8 at addr ffff8800a3a36bf8 by task kworker/u8:0/5
>
> while fuzzing with Syzkaller on 4.14-rc4 on x86_64. Included is the
> trace of the crash along with the programs running around the time of
> the crash.
>
> Programs can be found here: https://pastebin.com/RYGtNn3z
>
> Stack trace here: https://pastebin.com/SaJXWMg3
>
> We don't have a C reproducer but we will send one if we have it.
>
> Regards,
> Shankara
next prev parent reply other threads:[~2017-11-01 2:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-31 13:24 KASAN: use-after-free in move_expired_inodes Shankara Pailoor
2017-11-01 2:04 ` Shankara Pailoor [this message]
2017-11-15 13:41 ` Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAASgV=uFkfFg3HeG_GnHWbCc=-OFq6nqH7bDKQt2HymdD+wiDA@mail.gmail.com' \
--to=sp3485@columbia.edu \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).