Messages in this thread | | | Date | Wed, 03 Aug 2022 10:43:31 +0530 | From | Siddh Raman Pant <> | Subject | Re: [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue |
| |
On Wed, 03 Aug 2022 09:42:28 +0530 Eric Biggers <ebiggers@kernel.org> wrote: > Under what circumstances is the pipe pointer still being dereferenced after the > pipe has been freed? I don't see how it can be; see my explanation above.
It really didn't fix the crash. It caused the same crash reported here, which I was already locally getting: https://syzkaller.appspot.com/bug?extid=03d7b43290037d1f87ca
(It's same because __post_watch_notification calls post_one_notification, and this patch seems to stop that crash too, as was verified by Dipanjan here).
While it has been fixed by e64ab2dbd882 ("watch_queue: Fix missing locking in add_watch_to_object()"), it just shows there can be paths leading to it. (Also, I posted this patch (v1, v2, v3) before that even landed, so I had no way of knowing about it).
There is a null check in post_one_notification for the pipe, most probably because it *expects* the pointer to be NULL'd. Also, there is no reason to have a dangling pointer stay, it's just a recipe for further bugs.
Thanks, Siddh
| |