lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: KASAN: use-after-free Read in userfaultfd_release (2)
From
Date
On 7/20/20 9:00 AM, Al Viro wrote:
> On Mon, Jul 13, 2020 at 04:45:12PM +0800, Hillf Danton wrote:
>
>> Bridge the gap between slab free and the fput in task work wrt
>> file's private data.
>
> No. This
>
>> @@ -2048,6 +2055,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
>>
>> fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
>> if (fd < 0) {
>> + file->private_data = NULL;
>> fput(file);
>> goto out;
>> }
>>
>
> is fundamentally wrong; you really shouldn't take over the cleanups
> if you ever do fput().

Yep. I don't recall how the O_CLOEXEC got in there: that's indeed wrong,
and probably the result of patch-editing butchery. As for the exit
cleanup: yes, that's a bug. I was trying to keep the exit paths
together. We could fix it forward (which seems simple enough) or re-submit.

\
 
 \ /
  Last update: 2020-07-21 02:06    [W:0.152 / U:0.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site