2017-11-30 18:59:23

by Jason Baron

[permalink] [raw]
Subject: Re: BUG: KASAN: use-after-scope in ep_poll+0x5cd/0xc90

Hi,

On 11/29/2017 10:41 PM, Fengguang Wu wrote:
> Hello,
>
> FYI this happens in mainline kernel 4.15.0-rc1.
> It looks a new regression and bisect is on the way.
>
> It occurs in 3 out of 3 boots.
>
> [ 35.704690] init: Failed to create pty - disabling logging for job
> [ 35.706676] init: Temporary process spawn error: No such file or directory
> [ 35.731988] init: Failed to create pty - disabling logging for job
> [ 35.734084] init: Temporary process spawn error: No such file or directory
> [ 35.737946] ==================================================================
> [ 35.739635] BUG: KASAN: use-after-scope in ep_poll+0x5cd/0xc90:
> ep_send_events at fs/eventpoll.c:1700
> (inlined by) ep_poll at fs/eventpoll.c:1829

This seems to be pointing out that 'struct ep_send_events_data esed' on
line 1700 (below) is being used out of scope?

1697 static int ep_send_events(struct eventpoll *ep,

1698 struct epoll_event __user *events, int
maxevents)
1699 {

1700 struct ep_send_events_data esed;

1701

1702 esed.maxevents = maxevents;

1703 esed.events = events;

1704

1705 return ep_scan_ready_list(ep, ep_send_events_proc, &esed,
0, false);

There have been some epoll changes new to 4.15 that would be tempting to
blame, but I don't see anything obvious wrong and the usage of 'esed'
hasn't really changed.

So I'm curious to see where your bisect leads. There also seems to be a
number of reports of false positives with KASAN out of scope reported
recently, so I'm not sure if this could be a false positive?

Thanks,

-Jason

From 1585460928305556248@xxx Thu Nov 30 03:42:46 +0000 2017
X-GM-THRID: 1585460928305556248
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread