Re: KASAN: use-after-free Read in tcf_block_find

From: Dmitry Vyukov
Date: Thu Sep 27 2018 - 14:04:55 EST

On Thu, Sep 27, 2018 at 7:50 PM, Cong Wang <xiyou.wangcong@xxxxxxxxx> wrote:
> On Thu, Sep 27, 2018 at 1:11 AM Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> Would a stack trace for call_rcu be helpful here? I have this idea for
>> a long time, but never get around to implementing it:
> Yes. Generally speaking, showing backtrace of call_rcu()
> or schedule_work(0 etc. is very helpful, we are more interested
> in who calls call_rcu() than what that RCU callback does.
> BTW, yesterday I asked syzbot to test this:
> I still don't get any result.

I see that test job. It's in some dead loop, now trying to run for 37'th time.
I've just pushed a fix a bug that could have caused it (fuzzing the
fuzzer, we should go deeper!):
If it won't help, I will take a look tomorrow.

> For this specific bug, we should hold a refcnt in dev->qdisc, I don't
> even see how call_rcu() could be invoked, unless of course we mess
> up with qdisc refcnt.