On Fri, Dec 04, 2015 at 09:04:35PM +0100, Dmitry Vyukov wrote: > ================================================================== > BUG: KASAN: use-after-free in __lock_acquire+0x4e99/0x5100 at addr > ffff880038706e60 > Read of size 8 by task syzkaller_execu/6513 > ============================================================================= > BUG kmalloc-1024 (Not tainted): kasan: bad access detected > ----------------------------------------------------------------------------- > > Disabling lock debugging due to kernel taint > INFO: Allocated in alloc_perf_context+0x4c/0x100 age=263 cpu=1 pid=6428 > [< inline >] kzalloc include/linux/slab.h:602 > [< none >] alloc_perf_context+0x4c/0x100 kernel/events/core.c:3399 > [< none >] find_get_context+0x187/0x830 kernel/events/core.c:3506 > [< none >] SYSC_perf_event_open+0xe50/0x21a0 > kernel/events/core.c:8375 > [< none >] SyS_perf_event_open+0x39/0x50 kernel/events/core.c:8236 > [< none >] tracesys_phase2+0x88/0x8d arch/x86/entry/entry_64.S:269 > > INFO: Freed in free_ctx+0x4b/0x70 age=174 cpu=2 pid=8105 > [< none >] kfree+0x26f/0x3e0 mm/slub.c:3632 > [< none >] free_ctx+0x4b/0x70 kernel/events/core.c:872 > [< inline >] __rcu_reclaim kernel/rcu/rcu.h:118 > [< inline >] rcu_do_batch kernel/rcu/tree.c:2693 > [< inline >] invoke_rcu_callbacks kernel/rcu/tree.c:2961 > [< inline >] __rcu_process_callbacks kernel/rcu/tree.c:2928 > [< none >] rcu_process_callbacks+0x631/0x19e0 kernel/rcu/tree.c:2945 > [< none >] __do_softirq+0x2e5/0xb40 kernel/softirq.c:273 > [< inline >] invoke_softirq kernel/softirq.c:350 > [< none >] irq_exit+0x165/0x1e0 kernel/softirq.c:391 > [< inline >] exiting_irq ./arch/x86/include/asm/apic.h:653 > [< none >] smp_apic_timer_interrupt+0x88/0xc0 > arch/x86/kernel/apic/apic.c:926 > [< none >] apic_timer_interrupt+0x87/0x90 > arch/x86/entry/entry_64.S:678
So it would be _awesome_ if we could somehow extend this callchain to include the site that calls call_rcu(). In any case, this looks like we got the refcounting wrong some place, I'll go audit that stuff. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
