Haakon Bugge
unread,Oct 4, 2021, 12:02:24 PM10/4/21Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Sign in to report message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to Dmitry Vyukov, Jason Gunthorpe, Doug Ledford, syzbot, Leon Romanovsky, OFED mailing list, LKML, syzkall...@googlegroups.com
Looks to me as this is rxe:
[ 1892.778632][ T8958] BUG: KASAN: use-after-free in __rxe_drop_index_locked+0xb5/0x100
[snip]
[ 1892.822375][ T8958] Call Trace:
[ 1892.825655][ T8958] <TASK>
[ 1892.828594][ T8958] dump_stack_lvl+0xcd/0x134
[ 1892.833273][ T8958] print_address_description.constprop.0.cold+0x6c/0x30c
[ 1892.840316][ T8958] ? __rxe_drop_index_locked+0xb5/0x100
[ 1892.845864][ T8958] ? __rxe_drop_index_locked+0xb5/0x100
[ 1892.851424][ T8958] kasan_report.cold+0x83/0xdf
[ 1892.856200][ T8958] ? __rxe_drop_index_locked+0xb5/0x100
[ 1892.861761][ T8958] kasan_check_range+0x13d/0x180
[ 1892.866780][ T8958] __rxe_drop_index_locked+0xb5/0x100
[ 1892.872164][ T8958] __rxe_drop_index+0x3f/0x60
[ 1892.876850][ T8958] rxe_dereg_mr+0x14b/0x240
[ 1892.881381][ T8958] ib_dealloc_pd_user+0x96/0x230
[ 1892.886566][ T8958] rds_ib_dev_free+0xd4/0x3a0
So, RDS de-allocs its PD, ib core must first de-register the PD's local MR, calls rxe_dereg_mr(), ...
Thxs, Håkon