lkml.org 
[lkml]   [2021]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v5] x86/sgx: Fix use-after-free in sgx_mmu_notifier_release()
On Wed, Feb 03, 2021 at 07:46:48AM -0800, Dave Hansen wrote:
> On 1/30/21 11:20 AM, Jarkko Sakkinen wrote:
> ...
> > Example scenario would such that all removals "side-channel" through
> > the notifier callback. Then mmu_notifier_unregister() gets called
> > exactly zero times. No MMU notifier srcu sync would be then happening.
> >
> > NOTE: There's bunch of other examples, I'm just giving one.
>
> Could you flesh this out a bit? I don't quite understand the scenario
> from what you describe above.
>
> In any case, I'm open to other implementations that fix the race we know
> about. If you think you have a better fix, I'm happy to review it and
> make sure it closes the other race.

I'll bake up a new patch. Generally speaking, I think why this has been so
difficult, is because of a chicken-egg-problem. The whole issue should be
sorted when a new entry is first added to the mm_list, i.e. increase the
refcount for each added entry.

/Jarkko

\
 
 \ /
  Last update: 2021-02-03 22:56    [W:0.109 / U:0.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site