lkml.org 
[lkml]   [2022]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 4/6] mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs()
Date
On Fri, Aug 19, 2022 at 03:32:27PM +0800, Miaohe Lin wrote:
> On 2022/8/19 13:23, HORIGUCHI NAOYA(堀口 直也) wrote:
> > On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote:
> >> After kill_procs(), tk will be freed without being removed from the to_kill
> >> list. In the next iteration, the freed list entry in the to_kill list will
> >> be accessed, thus leading to use-after-free issue.
> >
> > kill_procs() runs over the to_kill list and frees all listed items in each
> > iteration. So just after returning from unmap_and_kill(), to_kill->next and
> > to_kill->prev still point to the addresses of struct to_kill which was the
> > first or last item (already freed!). This is bad-manered, but
> > collect_procs_fsdax() in the next iteration calls list_add_tail() and
> > overwrites the dangling pointers with newly allocated item. So this problem
>
> list_add_tail will do WRITE_ONCE(prev->next, new) where prev is already freed!
> Or am I miss something?

No, you're right. Thank you for explanation.

Thanks,
Naoya Horiguchi
\
 
 \ /
  Last update: 2022-08-19 10:19    [W:3.095 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site