lkml.org 
[lkml]   [2022]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [syzbot] KASAN: use-after-free Read in rxrpc_lookup_local
Date
Hillf Danton <hdanton@sina.com> wrote:

> To fix the uaf, destroy local in workqueue because of hlist_del under mutex.

Hmmm... That can't be the whole explanation. As you say, the hlist_del is
done under the mutex in rxrpc_destroy_local() - the same as the
hlist_add/hlist_replace and the search in rxrpc_lookup_local().

There should be no need to bump it off to a worker thread - the destruction is
in process context already - and doing the destruction not in the I/O thread
violates other assumptions, so I'm not convinced this patch is a valid fix.

I wonder if, under some circumstances, the I/O thread is managing to start and
destroy itself *before* rxrpc_lookup_local() adds itself to the
local_endpoints list. Possibly I should offload the add to the I/O thread and
use a completion to wait for it to set up.

David

\
 
 \ /
  Last update: 2022-12-07 13:01    [W:0.028 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site