On 05/13/2019 06:59 PM, Eric Dumazet wrote:
> synchronize_rcu() is fine when the rcu callbacks only need
> to free memory (kfree_rcu() or direct kfree() call rcu call backs)
>
> __dev_map_entry_free() is a bit more complex, so we need to make
> sure that call queued __dev_map_entry_free() callbacks have completed.
>
> sysbot report:
>
> BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365
> [inline]
> BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300
> kernel/bpf/devmap.c:379
> Read of size 8 at addr ffff8801b8da38c8 by task ksoftirqd/1/18
>
[...]
>
> Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references")
> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Reported-by: syzbot+457d3e2ffbcf31aee5c0@xxxxxxxxxxxxxxxxxxxxxxxxx
> Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
> Acked-by: Jesper Dangaard Brouer <brouer@xxxxxxxxxx>
Applied, thanks!
