From: Dmitry Vyukov <dvyukov@google.com>
To: Jason Gunthorpe <jgg@ziepe.ca>, syzkaller <syzkaller@googlegroups.com>
Cc: Hillf Danton <hdanton@sina.com>,
syzbot <syzbot+a929647172775e335941@syzkaller.appspotmail.com>,
chuck.lever@oracle.com, Doug Ledford <dledford@redhat.com>,
Leon Romanovsky <leon@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
RDMA mailing list <linux-rdma@vger.kernel.org>,
parav@mellanox.com, Markus Elfring <Markus.Elfring@web.de>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: use-after-free Read in addr_handler (2)
Date: Mon, 29 Jun 2020 16:42:08 +0200 [thread overview]
Message-ID: <CACT4Y+ab1q7fON3rkj+FHODPQXDGyP5c0tJt7gbrpmsAAYRb1g@mail.gmail.com> (raw)
In-Reply-To: <20200627222527.GC25301@ziepe.ca>
On Sun, Jun 28, 2020 at 12:25 AM Jason Gunthorpe <jgg@ziepe.ca> wrote:
>
> On Sat, Jun 27, 2020 at 09:02:05PM +0800, Hillf Danton wrote:
> > > So, to hit this syzkaller one of these must have happened:
> > > 1) rdma_addr_cancel() didn't work and the process_one_work() is still
> > > runnable/running
> >
> > What syzbot reported indicates that the kworker did survive not only
> > canceling work but the handler_mutex, despite it's a sync cancel that
> > waits for the work to complete.
>
> The syzbot report doesn't confirm that the cancel work was actaully
> called.
>
> The most likely situation is that it was skipped because of the state
> mangling the patch fixes..
>
> > > 2) The state changed away from RDMA_CM_ADDR_QUERY without doing
> > > rdma_addr_cancel()
> >
> > The cancel does cover the query state in the reported case, and have
> > difficult time working out what's in the patch below preventing the
> > work from going across the line the sync cancel draws. That's the
> > question we can revisit once there is a reproducer available.
>
> rdma-cm never seems to get reproducers from syzkaller
+syzkaller mailing list
Hi Jason,
Wonder if there is some systematic issue. Let me double check.
next prev parent reply other threads:[~2020-06-29 19:28 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-10 17:02 KASAN: use-after-free Read in addr_handler (2) syzbot
[not found] ` <20200614085321.8740-1-hdanton@sina.com>
2020-06-27 0:45 ` Jason Gunthorpe
2020-06-27 2:38 ` [PATCH] RDMA/cma: Execute rdma_cm destruction from a handler properly kernel test robot
[not found] ` <20200627130205.16900-1-hdanton@sina.com>
2020-06-27 22:25 ` KASAN: use-after-free Read in addr_handler (2) Jason Gunthorpe
2020-06-29 14:42 ` Dmitry Vyukov [this message]
2020-06-29 17:27 ` Dmitry Vyukov
2020-06-29 19:22 ` Jason Gunthorpe
2020-06-29 19:41 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACT4Y+ab1q7fON3rkj+FHODPQXDGyP5c0tJt7gbrpmsAAYRb1g@mail.gmail.com \
--to=dvyukov@google.com \
--cc=Markus.Elfring@web.de \
--cc=chuck.lever@oracle.com \
--cc=dledford@redhat.com \
--cc=hdanton@sina.com \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=parav@mellanox.com \
--cc=syzbot+a929647172775e335941@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).