On Mon, Oct 4, 2021 at 11:19 AM Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > > ebiederm@xxxxxxxxxxxx (Eric W. Biederman) writes: > > > Adding Rune Kleveland to the discussion as he also seems to have > > reproduced the issue. > > > > Alex and I have been starring at the code and the reports and this > > bug is hiding well. Here is what we have figured out so far. > > > > Both the warning from free_user_ns calling dec_ucount that Jordan Glover > > reported and the KASAN error that Yu Zhao has reported appear to have > > the same cause. Using a ucounts structure after it has been freed and > > reallocated as something else. > > > > I have just skimmed through the recent report from Rune Kleveland > > and it appears also to be a use after free. Especially since the > > second failure in the log is slub complaining about trying to free > > the ucounts data structure. > > > > We looked through the users of put_ucounts and we don't see any obvious > > buggy users that would be freeing the data structure early. > > > > Alex has tried to reproduce this so far is not having any luck. > > Folks can you tell what compiler versions you are using and share your > > kernel config with us? That might help. Thanks. Per your request: $ aarch64-cros-linux-gnu-clang -v Chromium OS 12.0_pre422132_p20210405-r9 clang version 13.0.0 (/var/tmp/portage/sys-devel/llvm-12.0_pre422132_p20210405-r9/work/llvm-12.0_pre422132_p20210405/clang cd442157cff4aad209ae532cbf031abbe10bc1df) Target: aarch64-cros-linux-gnu Thread model: posix InstalledDir: /usr/bin Found candidate GCC installation: /usr/bin/../lib/gcc/aarch64-cros-linux-gnu/10.2.0 Found candidate GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Selected GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Candidate multilib: .;@m64 Selected multilib: .;@m64 Kernel config attached.
Attachment:
kernel.config
Description: Binary data
