From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57D02C07E9B for ; Tue, 20 Jul 2021 16:33:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 360A7610C7 for ; Tue, 20 Jul 2021 16:33:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229949AbhGTPwv (ORCPT ); Tue, 20 Jul 2021 11:52:51 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:42868 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231367AbhGTPtS (ORCPT ); Tue, 20 Jul 2021 11:49:18 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out01.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1m5scr-006k9t-Cx; Tue, 20 Jul 2021 10:29:45 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95]:50058 helo=email.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1m5scp-006F6J-As; Tue, 20 Jul 2021 10:29:44 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Hillf Danton Cc: syzbot , legion@kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com References: <000000000000efe97f05c74bb995@google.com> <20210719094432.425-1-hdanton@sina.com> <20210720041451.766-1-hdanton@sina.com> Date: Tue, 20 Jul 2021 11:29:09 -0500 In-Reply-To: <20210720041451.766-1-hdanton@sina.com> (Hillf Danton's message of "Tue, 20 Jul 2021 12:14:51 +0800") Message-ID: <87y2a1q78q.fsf@disp2133> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1m5scp-006F6J-As;;;mid=<87y2a1q78q.fsf@disp2133>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/CsiqgU4gH+PrUqxRLgvuy1Drl/YoBycA= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [syzbot] KASAN: use-after-free Write in put_ucounts X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hillf Danton writes: > On Mon, 19 Jul 2021 12:24:41 -0500 Eric W. Biederman wrote: >>> >>> To fix the uaf, add a couple of changes. Now only for thoughts. >>> >>> 1/ s/atomic_add_negative/atomic_inc_not_zero/ to correct the get >>> method. >> >>I really don't think so. The use of atomic_add_negative is very >>deliberate. Changing that fundamentally changes the algorithm into used > > Given atomic_dec_and_test() in put_ucounts(), what sense are you > deliberately trying to make by bumping up a zero count? > >>to keep track of things. Definitely not something to lead with. >> >>Before it even makes sense to talk about how to change the code, >>a plausible explanation for how a use after free happens is needed. > > I am trying just to avoid touching zero count. That is it. Observing a zero-reference count in this case is a result of a use-after-free. So that is definitely not what needs to be fixed. >>That explanation should account for the fact this code was in linux-next >>the since last -rc1 without any kind of issue with the test code. > > The code is no good without surviving syzbot, right? And -rcX does not > matter. That was with syzbot running against linux-next for 8ish weeks. Something changed that syzbot is now reporting an error. It is definitely worth fixing but we need to track down and understand what the bug is. Eric