[lkml]   [2018]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: KASAN: use-after-free Read in link_path_walk
On Tue, Jul 24, 2018 at 06:17:26AM +0100, Al Viro wrote:

> Do we have LOOKUP_RCU in nd->flags at that point? And how in hell
> did we get that dentry there? In LOOKUP_RCU mode no freeing should
> be happening until after we call rcu_read_unlock(), unless the final
> dput() has happened before rcu_read_lock(). In which case we shouldn't
> have gotten to that dentry in the first place.

... except that we never set DCACHE_RCUACCESS for root dentry. Which
invalidates the normal "if we run into dentry in lazy mode, its memory
won't be freed until we drop rcu_read_lock"... d_make_root() definitely
needs to set DCACHE_RCUACCESS; whether it's all there is or you are
hitting something else is a separate question, of course...

> And in non-LOOKUP_RCU
> mode we are bloody well holding references to everything (vfsmount
> and dentry alike), so that deactivate_super() shouldn't have been
> called as long as we are holding that reference.
> Details, please. Ideally - how to reproduce that.

Is there any way to tell KASAN that we want a crashdump triggered?
That would've been really useful for post-mortems...

 \ /
  Last update: 2018-08-06 15:02    [W:0.112 / U:0.840 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site