Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1589570

Re: net/rds: use-after-free in inet_create

Show all headers | View raw

On (02/28/17 15:22), Dmitry Vyukov wrote:
> 
> Hello,
> 
> I've got the following report while running syzkaller fuzzer on
> linux-next/8d01c069486aca75b8f6018a759215b0ed0c91f0. So far it
> happened only once. net was somehow deleted from underneath
> inet_create. I've noticed that rds uses sock_create_kern which does
> not take net reference. What is that that must keep net alive then?

The rds_connection (which is where the net pointer is being obtained from)
should keep the connection alive. Did you have the rds[_tcp] modules
loaded at the time of failure? Were there kernel tcp sockets to/from
the 16385 port? any hints on what else the test was doing (was it
running a userspace RDS application that triggered the kernel TCP
connection attempt in the first place)?

--Sowmini

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 16:00 +0100
  Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 16:40 +0100
    Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:00 +0100
      Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:20 +0100
        Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:40 +0100
          Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:50 +0100
            Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 18:00 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 18:40 +0100
                Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 19:00 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 20:10 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-03-01 01:10 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-03-01 11:00 +0100

csiph-web