On Sep 22, 2018, at 8:27 AM, Hangbin Liu wrote:
>
> On Fri, Sep 21, 2018 at 07:48:25AM +, Jorgen S. Hansen wrote:
>> Hi Hangbin,
>>
>> I finaly got to the bottom of this - the issue was indeed in the VMCI
>> driver. The patch is posted here:
>>
>> https://na01.safelinks.protection.outlook.
On Fri, Sep 21, 2018 at 07:48:25AM +, Jorgen S. Hansen wrote:
> Hi Hangbin,
>
> I finaly got to the bottom of this - the issue was indeed in the VMCI driver.
> The patch is posted here:
>
> https://lkml.org/lkml/2018/9/21/326
>
> I used your reproduce.log to test the fix. Thanks for discove
: Hangbin Liu
Sent: Wednesday, June 13, 2018 3:44 AM
To: Jorgen S. Hansen
Cc: Stefan Hajnoczi; netdev@vger.kernel.org; David S. Miller
Subject: Re: [PATCH net] VSOCK: check sk state before receive
On Mon, Jun 04, 2018 at 04:02:39PM +, Jorgen S. Hansen wrote:
>
> > On May 30, 2018, at
On Mon, Jun 04, 2018 at 04:02:39PM +, Jorgen S. Hansen wrote:
>
> > On May 30, 2018, at 11:17 AM, Stefan Hajnoczi wrote:
> >
> > On Sun, May 27, 2018 at 11:29:45PM +0800, Hangbin Liu wrote:
> >> Hmm...Although I won't reproduce this bug with my reproducer after
> >> apply my patch. I could s
> On May 30, 2018, at 11:17 AM, Stefan Hajnoczi wrote:
>
> On Sun, May 27, 2018 at 11:29:45PM +0800, Hangbin Liu wrote:
>> Hmm...Although I won't reproduce this bug with my reproducer after
>> apply my patch. I could still get a similiar issue with syzkaller sock vnet
>> test.
>>
>> It looks t
On Sun, May 27, 2018 at 11:29:45PM +0800, Hangbin Liu wrote:
> Hmm...Although I won't reproduce this bug with my reproducer after
> apply my patch. I could still get a similiar issue with syzkaller sock vnet
> test.
>
> It looks this patch is not complete. Here is the KASAN call trace with my
>
Hmm...Although I won't reproduce this bug with my reproducer after
apply my patch. I could still get a similiar issue with syzkaller sock vnet
test.
It looks this patch is not complete. Here is the KASAN call trace with my patch.
I can also reproduce it without my patch.
Since vmci_transport_recv_dgram_cb is a callback function and we access the
socket struct without holding the lock here, there is a possibility that
sk has been released and we use it again. This may cause a NULL pointer
dereference later, while receiving. Here is the call trace:
[ 389.486319] BU
