Messages in this thread | | | Date | Mon, 19 Sep 2022 07:35:34 -1000 | From | Tejun Heo <> | Subject | Re: [PATCH v2] kernfs: fix use-after-free in __kernfs_remove |
| |
On Tue, Sep 13, 2022 at 02:17:23PM +0200, Christian A. Ehrhardt wrote: > Syzkaller managed to trigger concurrent calls to > kernfs_remove_by_name_ns() for the same file resulting in > a KASAN detected use-after-free. The race occurs when the root > node is freed during kernfs_drain(). > > To prevent this acquire an additional reference for the root > of the tree that is removed before calling __kernfs_remove(). ... > cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > cc: Tejun Heo <tj@kernel.org> > Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Acked-by: Tejun Heo <tj@kernel.org>
Thanks.
-- tejun
| |