Messages in this thread | | | From | (Eric W. Biederman) | Date | Thu, 18 Nov 2021 13:46:05 -0600 | Subject | Re: BUG: KASAN: use-after-free in dec_rlimit_ucounts |
| |
Qian Cai <quic_qiancai@quicinc.com> writes:
> Hi there, I can still reproduce this quickly on today's linux-next and all > the way back to 5.15-rc6 by running a syscall fuzzer for a while. The trace > points out to this line, > > for (iter = ucounts; iter; iter = iter->ns->ucounts) { > > It looks KASAN indicated that that "ns" had already been freed. Is that > possible or perhaps this is more of refcount issue?
Is it possible? Yes it is possible. That is one place where a use-after-free has shown up and I expect would show up in the future.
That said it is hard to believe there is still a user-after-free in the code. We spent the last kernel development cycle pouring through and correcting everything we saw until we ultimately found one very subtle use-after-free.
If you have a reliable reproducer that you can share, we can look into this and see if we can track down where the reference count is going bad.
It tends to take instrumenting the entire life cycle every increment and every decrement and then pouring through the logs to track down a use-after-free. Which is not something we can really do without a reproducer.
Eric
| |