Messages in this thread | | | Date | Mon, 20 Jul 2020 17:00:59 +0100 | From | Al Viro <> | Subject | Re: KASAN: use-after-free Read in userfaultfd_release (2) |
| |
On Mon, Jul 13, 2020 at 04:45:12PM +0800, Hillf Danton wrote:
> Bridge the gap between slab free and the fput in task work wrt > file's private data.
No. This
> @@ -2048,6 +2055,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > > fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC); > if (fd < 0) { > + file->private_data = NULL; > fput(file); > goto out; > } >
is fundamentally wrong; you really shouldn't take over the cleanups if you ever do fput().
| |