Messages in this thread | | | Date | Mon, 17 Apr 2023 16:00:11 -0700 | From | Peilin Ye <> | Subject | Re: [syzbot] [net?] KASAN: slab-use-after-free Write in mini_qdisc_pair_swap |
| |
Hi all,
On Mon, Apr 03, 2023 at 11:58:44AM -0400, Jamal Hadi Salim wrote: > To provide more update: > Happens on single processor before Seth's patches; and only on > multi-processor after Seth's patches. > Theory is: there is a logic bug in the miniqdisc rcu visibility. Feels > like the freeing of the structure is done without rcu involvement. > Jiri/Cong maybe you can take a look since youve been dabbling in > miniqdisc? The reproducer worked for me and Pedro 100% of the time.
I also reproduced this UAF using the syzkaller reproducer in the report (the C reproducer did not work for me for unknown reasons). I will look into this.
Thanks, Peilin Ye
| |