From: lee bruce <xrivendell7@gmail.com>
To: Hillf Danton <hdanton@sina.com>
Cc: syzbot+68619f9e9e69accd8e0a@syzkaller.appspotmail.com,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
Edward Adam Davis <eadavis@qq.com>,
clf700383@gmail.com, michael.christie@oracle.com,
mst@redhat.com, luto@kernel.org, peterz@infradead.org,
Thomas Gleixner <tglx@linutronix.de>,
ebiederm@xmission.com
Subject: Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in kill_orphaned_pgrp (2)
Date: Sun, 12 May 2024 21:36:56 +0800 [thread overview]
Message-ID: <CABOYnLxHfNwD_9WthyVS+9xhczUxFYkpAhRQ0mNugwzqwzZwiw@mail.gmail.com> (raw)
In-Reply-To: <CABOYnLzuu=i42tX-VSbTKJBfU=orsXa3Q5kCELOCsOFZCSdAaQ@mail.gmail.com>
Hi.
2024年5月12日 09:40，lee bruce <xrivendell7@gmail.com> 写道：
Hi.
Hillf Danton <hdanton@sina.com> 于2024年5月12日周日 07:34写道：
On Sat, 11 May 2024 22:45:06 +0800 lee bruce <xrivendell7@gmail.com>
Hello, I found a reproducer for this bug.
Thanks for your report.
If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@gmail.com>
Reported-by: lingfei cheng <clf700383@gmail.com>
I use the same kernel as syzbot instance
Kernel Commit: upstream dccb07f2914cdab2ac3a5b6c98406f765acab803
Kernel Config: https://syzkaller.appspot.com/text?tag=3DKernelConfig&x=3D6d14c12b661fb43
with KASAN enabled
Since the same title bug is triggered in
https://syzkaller.appspot.com/bug?id=3D70492b96ff47ff70cfc433be100586119310670b.
I make a simple RCA.
In the old-syzbot instance the bug still trigger the title "KASAN:
slab-use-after-free Read in kill_orphaned_pgrp=E2=80=9D and in the lastest
syzbot the bug report as
TITLE: WARNING in signal_wake_up_state
------------[ cut here ]------------
WARNING: CPU: 3 PID: 8591 at kernel/signal.c:762
signal_wake_up_state+0xf8/0x130 kernel/signal.c:762
Modules linked in:
CPU: 3 PID: 8591 Comm: file0 Not tainted 6.9.0-rc7-00012-gdccb07f2914c #6
Could you reproduce it in the next tree, because of d558664602d3 ("vhost_task:
Handle SIGKILL by flushing work and exiting") adding reaction to signal?
I test the kernel linux-next: d558664602d3906866e604a618dcf67f66d79967
and comfired reproducer and didn’t trigger any crashes.
I notice maybe this bug is duplicated with
https://syzkaller.appspot.com/bug?extid=98edc2df894917b3431f and
https://syzkaller.appspot.com/bug?extid=c6d438f2d77f96cae7c2.
Should we need to close or tag duplicated or fix to them?
Ok, I'll try.
Best Regards,
xingwei lee
next prev parent reply other threads:[~2024-05-12 13:37 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-11 14:45 [syzbot] [kernel?] KASAN: slab-use-after-free Read in kill_orphaned_pgrp (2) lee bruce
2024-05-11 23:34 ` Hillf Danton
2024-05-12 1:40 ` lee bruce
2024-05-12 13:36 ` lee bruce [this message]
2024-05-12 22:23 ` Hillf Danton
-- strict thread matches above, loose matches on Subject: below --
2024-05-08 18:04 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CABOYnLxHfNwD_9WthyVS+9xhczUxFYkpAhRQ0mNugwzqwzZwiw@mail.gmail.com \
--to=xrivendell7@gmail.com \
--cc=clf700383@gmail.com \
--cc=eadavis@qq.com \
--cc=ebiederm@xmission.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=michael.christie@oracle.com \
--cc=mst@redhat.com \
--cc=peterz@infradead.org \
--cc=syzbot+68619f9e9e69accd8e0a@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).