Re: net/rds: use-after-free in inet_create

From	Sowmini Varadhan <sowmini.varadhan@oracle.com>
Newsgroups	linux.kernel
Subject	Re: net/rds: use-after-free in inet_create
Date	2017-02-28 18:40 +0100
Message-ID	<tfTUK-7EU-23@gated-at.bofh.it> (permalink)
References	(2 earlier) <tfSlY-6te-23@gated-at.bofh.it> <tfSFj-6Rj-1@gated-at.bofh.it> <tfSYG-70r-9@gated-at.bofh.it> <tfT8m-75J-13@gated-at.bofh.it> <tfTi1-79a-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On (02/28/17 17:51), Dmitry Vyukov wrote:
> Searching other crashes for "net/rds" I found 2 more crashes that may
> be related. They suggest that the delayed works are not properly
> stopped when the socket is destroyed. That would explain how
> rds_connect_worker accesses freed net, right?

yes, I think we may want to explicitly cancel this workq.. this
in rds_conn_destroy().

I'm trying to build/sanity-test (if lucky, reproduce the bug)
as I send this out.. let me get back to you..

If I have a patch against net-next, would you be willing/able to 
try it out? given that this does not show up on demand, I'm not
sure how we can check that "the fix worked"..

--Sowmini

Thread

net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 16:00 +0100
  Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 16:40 +0100
    Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:00 +0100
      Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:20 +0100
        Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:40 +0100
          Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:50 +0100
            Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 18:00 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 18:40 +0100
                Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 19:00 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 20:10 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-03-01 01:10 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-03-01 11:00 +0100

csiph-web