linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Miklos Szeredi <miklos@szeredi.hu>
To: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: syzbot <syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: use-after-free Read in fuse_dev_do_read
Date: Mon, 24 Sep 2018 16:27:21 +0200	[thread overview]
Message-ID: <CAJfpeguTiN22KqMCH9NMs0Hj+ZcshdzFUk7Mb38Jt0ewHEOHpg@mail.gmail.com> (raw)
In-Reply-To: <be262e04-df8a-c248-26a8-d42bf081be1c@virtuozzo.com>

On Mon, Sep 24, 2018 at 2:06 PM, Kirill Tkhai <ktkhai@virtuozzo.com> wrote:

> Fix from my previous message makes the use-after-free does not reproduce
> with the reproducer in my setup.

Excellent.

>
> I can prepare the patch, but before this some comments from Miklos would
> be welcome.
>
> Miklos, what you think about this?

I like the patch.

We could optimize away the get/put by moving the set_bit/test_bit part
inside the fpq->lock-ed region and only get the refcount for the
(unlikely) interrupted case.  OTOH it's probably not worth the extra
complexity, so let's stay with this simpler fix.

Thanks,
Miklos

      reply	other threads:[~2018-09-24 20:29 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-13  8:00 KASAN: use-after-free Read in fuse_dev_do_read syzbot
2018-09-13  8:51 ` Kirill Tkhai
2018-09-13  8:59   ` Dmitry Vyukov
2018-09-22 19:30 ` syzbot
2018-09-24 12:06   ` Kirill Tkhai
2018-09-24 14:27     ` Miklos Szeredi [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAJfpeguTiN22KqMCH9NMs0Hj+ZcshdzFUk7Mb38Jt0ewHEOHpg@mail.gmail.com \
    --to=miklos@szeredi.hu \
    --cc=dvyukov@google.com \
    --cc=ktkhai@virtuozzo.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).