Re: [PATCH] 9p: fix Use-After-Free in p9_write_work()

From: Dmitry Vyukov
Date: Mon Jul 30 2018 - 01:55:23 EST


On Mon, Jul 30, 2018 at 1:33 AM, Dominique Martinet
<asmadeus@xxxxxxxxxxxxx> wrote:
> Tomas Bortoli wrote on Sun, Jul 29, 2018:
>> There is a race condition between p9_free_req() and p9_write_work().
>> A request might still need to be processed while p9_free_req() is called.
>>
>> To fix it, flush the read/write work before freeing any request.
>>
>> Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
>> Reported-by: syzbot+467050c1ce275af2a5b8@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> It looks like I have not received this report, I found it through google
> in the lkml archives

But you should have been received it? Or not?
We had some complaints that syzbot emails were not delivered, but in
these cases they were not delivered to lkml, and only to explicitly
CCed people.

> but Dmitry do you have a convenient-ish way of
> finding the report on the syzkaller website with that reported-by tag?

Well, you can do:
http://syzkaller.appspot.com/bug?extid=467050c1ce275af2a5b8