Re: KASAN: use-after-free Read in alloc_pid

From: Eric W. Biederman
Date: Mon Apr 02 2018 - 19:02:14 EST

syzbot <syzbot+7a1cff37dbbef9e7ba4c@xxxxxxxxxxxxxxxxxxxxxxxxx> writes:

> Hello,
> syzbot hit the following crash on upstream commit
> 9dd2326890d89a5179967c947dab2bab34d7ddee (Fri Mar 30 17:29:47 2018 +0000)
> Merge tag 'ceph-for-4.16-rc8' of git://
> syzbot dashboard link:
> So far this crash happened 4 times on upstream.
> Unfortunately, I don't have any reproducer for this crash yet.

Do you have any of the other traces? This looks like a something is
calling put_pid_ns more than it is calling get_pid_ns causing a
reference count mismatch.

If this is not: 9ee332d99e4d5a97548943b81c54668450ce641b

I could use a few more hints to help narrow down what is going wrong.

It would be nice to know what the other 3 crashes looked like and
exactly which upstream they were on.