Messages in this thread | | | From | HORIGUCHI NAOYA(堀口 直也) <> | Subject | Re: [PATCH 4/6] mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs() | Date | Fri, 19 Aug 2022 08:17:32 +0000 |
| |
On Fri, Aug 19, 2022 at 03:32:27PM +0800, Miaohe Lin wrote: > On 2022/8/19 13:23, HORIGUCHI NAOYA(堀口 直也) wrote: > > On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote: > >> After kill_procs(), tk will be freed without being removed from the to_kill > >> list. In the next iteration, the freed list entry in the to_kill list will > >> be accessed, thus leading to use-after-free issue. > > > > kill_procs() runs over the to_kill list and frees all listed items in each > > iteration. So just after returning from unmap_and_kill(), to_kill->next and > > to_kill->prev still point to the addresses of struct to_kill which was the > > first or last item (already freed!). This is bad-manered, but > > collect_procs_fsdax() in the next iteration calls list_add_tail() and > > overwrites the dangling pointers with newly allocated item. So this problem > > list_add_tail will do WRITE_ONCE(prev->next, new) where prev is already freed! > Or am I miss something?
No, you're right. Thank you for explanation.
Thanks, Naoya Horiguchi | |