Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-11-17 Thread Baozeng Ding
Hello Guillaume, On 2016/11/17 5:07, Guillaume Nault wrote: > On Wed, Nov 16, 2016 at 11:08:23AM -0800, Cong Wang wrote: >> On Wed, Nov 16, 2016 at 8:30 AM, Guillaume Nault >> wrote: >>> diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c >>> index fce25af..982f6c4 100644 >>> --- a/net/l2tp/l2t

Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-11-16 Thread Guillaume Nault
On Wed, Nov 16, 2016 at 11:08:23AM -0800, Cong Wang wrote: > On Wed, Nov 16, 2016 at 8:30 AM, Guillaume Nault wrote: > > diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c > > index fce25af..982f6c4 100644 > > --- a/net/l2tp/l2tp_ip.c > > +++ b/net/l2tp/l2tp_ip.c > > @@ -251,8 +251,6 @@ static i

Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-11-16 Thread Cong Wang
On Wed, Nov 16, 2016 at 8:30 AM, Guillaume Nault wrote: > diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c > index fce25af..982f6c4 100644 > --- a/net/l2tp/l2tp_ip.c > +++ b/net/l2tp/l2tp_ip.c > @@ -251,8 +251,6 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr > *uaddr, int addr_le

Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-11-16 Thread Guillaume Nault
On Wed, Oct 19, 2016 at 10:52:03PM +0800, Baozeng Ding wrote: > This use-after-free seems to be triggered by some race. I use stress tool for > this: > https://github.com/golang/tools/blob/master/cmd/stress/stress.go > If you have Go toolchain installed, then the following will do: > $ go get g

Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-10-19 Thread Baozeng Ding
This use-after-free seems to be triggered by some race. I use stress tool for this: https://github.com/golang/tools/blob/master/cmd/stress/stress.go If you have Go toolchain installed, then the following will do: $ go get golang.org/x/tools/cmd/stress $ stress ./a.out

Re: net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-10-16 Thread Cong Wang
On Sun, Oct 16, 2016 at 8:07 AM, Baozeng Ding wrote: > Hello, > While running syzkaller fuzzer I have got the following use-after-free > bug in l2tp_ip6_close. The kernel version is 4.8.0+ (on Oct 7 commit > d1f5323370fceaed43a7ee38f4c7bfc7e70f28d0). > > BUG: KASAN: use-after-free in l2tp_ip6_clo

net/l2tp:BUG: KASAN: use-after-free in l2tp_ip6_close

2016-10-16 Thread Baozeng Ding
Hello, While running syzkaller fuzzer I have got the following use-after-free bug in l2tp_ip6_close. The kernel version is 4.8.0+ (on Oct 7 commit d1f5323370fceaed43a7ee38f4c7bfc7e70f28d0). BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr 8800081b0ed8 Write of size 8 by task