Re: KASAN: use-after-free Read in __list_add_valid (5)

From: Roland Dreier
Date: Tue May 15 2018 - 16:49:50 EST


> Still reproducible on Linus' tree (commit 66e1c94db3cd4e) and on linux-next
> (next-20180511). Here's a simplified reproducer:

Thanks! That's a fantastic test case.

The issue is a race where rdma_listen() sees invalid state in the
middle of an rdma_bind_addr() call that will ultimately fail. I'll
send a proposed patch shortly.

- R.