From: Daniel Borkmann <daniel@iogearbox.net>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>,
syzbot <syzbot+7a8ba368b47fdefca61e@syzkaller.appspotmail.com>,
Alexei Starovoitov <ast@kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: use-after-free Read in path_lookupat
Date: Mon, 25 Mar 2019 23:41:39 +0100 [thread overview]
Message-ID: <79dfc903-cf0d-0091-ef96-76c2749abb9c@iogearbox.net> (raw)
In-Reply-To: <CAHk-=wjD-A_VsYC_OKcn30_ZsrLEE1CN7mnwZ803cvaFTdTTfA@mail.gmail.com>
On 03/25/2019 11:13 PM, Linus Torvalds wrote:
> On Mon, Mar 25, 2019 at 3:04 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>>
>> I'm fine either way, I think the rcu_destroy_inode would indeed simplify
>> it nicely. In any case fwiw, here's what I'd have ready for standby on bpf
>> side and tested as well. Decided to get rid of bpf_evict_inode() entirely
>> since the only callback we'd really need is on final inode destruction:
>
> Yes, this looks correct to me.
>
> I think this is worth doing regardless. Even if we then make the vfs
> layer add that rcu_destroy_inode(), that will fit very well with this
> patch, and getting rid of the special bpf_evict_inode() logic and just
> letting the normal vfs inode cleanup happen looks like the right
> thing.
>
> So ack from me on your
>
>> Subject: [PATCH bpf] bpf: fix use after free in bpf_evict_inode
>
> patch regardless of what else we might end up doing in this area to
> clean things up.
Ok, thanks a lot. In that case, I just pushed this one to bpf tree, and
it will come your way the usual route via David.
Thanks,
Daniel
next prev parent reply other threads:[~2019-03-25 22:41 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-28 17:40 KASAN: use-after-free Read in path_lookupat syzbot
2019-03-25 0:44 ` syzbot
2019-03-25 1:25 ` Linus Torvalds
2019-03-25 1:23 ` Linus Torvalds
2019-03-25 4:57 ` Al Viro
2019-03-25 9:15 ` Daniel Borkmann
2019-03-25 11:11 ` Al Viro
2019-03-25 11:17 ` Al Viro
2019-03-25 11:21 ` Daniel Borkmann
2019-03-25 18:36 ` Linus Torvalds
2019-03-25 19:18 ` Linus Torvalds
2019-03-25 21:14 ` Al Viro
2019-03-25 21:45 ` Linus Torvalds
2019-03-25 22:04 ` Daniel Borkmann
2019-03-25 22:13 ` Linus Torvalds
2019-03-25 22:41 ` Daniel Borkmann [this message]
2019-03-25 22:49 ` Al Viro
2019-03-25 23:37 ` Al Viro
2019-03-25 23:44 ` Alexei Starovoitov
2019-03-26 0:21 ` Al Viro
2019-03-26 1:38 ` ceph: fix use-after-free on symlink traversal Al Viro
2019-03-26 1:39 ` jffs2: " Al Viro
2019-03-26 1:40 ` ubifs: " Al Viro
2019-03-26 1:43 ` debugfs: " Al Viro
2019-03-26 10:41 ` ceph: " Jeff Layton
2019-03-26 11:38 ` Ilya Dryomov
2019-03-26 1:45 ` KASAN: use-after-free Read in path_lookupat Al Viro
2019-04-10 18:11 ` Al Viro
2019-04-10 19:44 ` Linus Torvalds
2019-03-25 19:43 ` Al Viro
2019-03-25 22:48 ` Dave Chinner
2019-03-25 23:02 ` Al Viro
[not found] ` <CAGe7X7mb=gK7zhSwmT_6mmmkcbjhZAOb=wj31BdUcHkNUPsm2Q@mail.gmail.com>
2019-03-26 4:15 ` Al Viro
2019-03-27 16:58 ` Jan Kara
2019-03-27 18:59 ` Al Viro
2019-03-28 9:00 ` Jan Kara
2019-03-27 17:22 ` Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=79dfc903-cf0d-0091-ef96-76c2749abb9c@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=ast@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+7a8ba368b47fdefca61e@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).