lkml.org 
[lkml]   [2020]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectReporting a use-after-free read bug in userfaultfd_release()
Hi all,

Syzbot reported the following use-after-free bug in
userfaultfd_release():

https://syzkaller.appspot.com/bug?id=4b9e5aea757b678d9939c364e50212354a3480a6

It seems to be caused by this patch. I took a look at the stack trace.
In the patch:

fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
if (fd < 0) {
fput(file);
goto out;
}

If get_unused_fd_flags() fails, `ctx` is freed. Later however, before
returning back to userland, userfaultfd_release() is called and tries to
use `ctx` again, causing a use-after-free bug.

The syzbot reproducer does a setrlimit() then a userfaultfd(). The
former sets a hard limit on number of open files to zero, which causes
get_unused_fd_flags() to fail.

Thank you,

Peilin Ye

\
 
 \ /
  Last update: 2020-07-17 13:46    [W:0.024 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site