All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oleg Nesterov <oleg@redhat.com>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: serge@hallyn.com,
	syzbot <syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com>,
	jmorris@namei.org, keescook@chromium.org,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in task_is_descendant
Date: Fri, 26 Oct 2018 16:39:37 +0200	[thread overview]
Message-ID: <20181026143937.GA18848@redhat.com> (raw)
In-Reply-To: <522c4993-4d98-be98-def2-452ed28098f9@i-love.sakura.ne.jp>

On 10/26, Tetsuo Handa wrote:
>
> On 2018/10/26 22:04, Oleg Nesterov wrote:
> >> Suppose p1 == p2->real_parent and p2 == p3->real_parent, and p1 exited
> >> when p2 tried to attach on p1, p2->real_parent was pointing to already
> >> (or about to be) freed p1.
> >
> > No, p2->real_parent will be updated. If p1 exits it will re-parent its
> > children including p2.
>
> My error.
>
> Suppose p1 == p2->real_parent and p2 == p3->real_parent, and p1 exited
> when someone tried to attach on p2, p2->real_parent was pointing to already
> (or about to be) freed p1.

I don't see a difference.

If p1 exits it will re-parent p2, p2->real_parent will be updated.

> So, the puzzle part is why p2->real_parent was still pointing p1 even after
> p1 was freed...

I don't understand the question.

Once again. TASK->real_parent can point to the freed mem only if a) TASK exits,
and b) _after_ that its parent TASK->real_parent exits too.

> > Again, did you read my previous email?
>
> Yes. But I still can't be convinced that pid_alive() test helps.

Well, I don't understand which part of my explanations is not clear to you.

OR. Perhaps I am wrong and do not understand your concerns.

Oleg.


  reply	other threads:[~2018-10-26 14:39 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-21  7:10 KASAN: use-after-free Read in task_is_descendant syzbot
2018-10-21  7:12 ` Tetsuo Handa
2018-10-22  9:54   ` Oleg Nesterov
2018-10-22 10:06     ` Tetsuo Handa
2018-10-22 13:46       ` Oleg Nesterov
2018-10-25  2:15         ` Tetsuo Handa
2018-10-25 11:13           ` Oleg Nesterov
2018-10-25 11:36             ` Kees Cook
2018-10-25 12:05               ` Oleg Nesterov
2018-10-25 11:47             ` Tetsuo Handa
2018-10-25 12:17               ` Oleg Nesterov
2018-10-25 13:01                 ` Oleg Nesterov
2018-10-26 16:09                   ` Kees Cook
2018-10-29 12:23                     ` Oleg Nesterov
2018-10-29 15:05                       ` yama: unsafe usage of ptrace_relation->tracer Oleg Nesterov
2019-01-10 11:05                         ` Tetsuo Handa
2019-01-10 18:47                           ` Kees Cook
2019-01-16 17:40                           ` Oleg Nesterov
2018-10-25 13:14                 ` KASAN: use-after-free Read in task_is_descendant Tetsuo Handa
2018-10-25 15:55                   ` Oleg Nesterov
2018-10-25 16:25                     ` Oleg Nesterov
2018-10-26 12:23                     ` Tetsuo Handa
2018-10-26 13:04                       ` Oleg Nesterov
2018-10-26 13:51                         ` Tetsuo Handa
2018-10-26 14:39                           ` Oleg Nesterov [this message]
2018-10-26 15:04                             ` Tetsuo Handa
2018-10-26 15:22                               ` Oleg Nesterov
2018-10-25  8:19     ` Kees Cook
2018-10-25 11:52       ` Oleg Nesterov
2018-11-10  3:25 ` syzbot
2018-11-10 11:46 ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181026143937.GA18848@redhat.com \
    --to=oleg@redhat.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=serge@hallyn.com \
    --cc=syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.