Re: KASAN: use-after-free Read in rds_tcp_dev_event

On (11/13/17 19:30), Girish Moodalbail wrote:

(L538-540). However, it leaves behind some of the rds_tcp connections that
shared the same underlying RDS connection (L534 and 535). These connections
with pointer to stale network namespace are left behind in the global list.

It leaves behind no such thing. After mprds, you want to collect
only one instance of the conn that is being removed, that's why
lines 534-535 skips over duplicat instances of the same conn
(for multiple paths in the same conn).

When the 2nd network namespace is deleted, we will hit the above stale
pointer and hit UAF panic.
I think we should move away from global list to a per-namespace list. The
global list are used only in two places (both of which are per-namespace
operations):

Nice try, but not so. 

Let me look at this tomorrow, I missed this mail in my mbox.

--Sowmini

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html