[lkml]   [2020]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[RFC 0/3] block: address blktrace use-after-free
Upstream korg#205713 contends that there is a UAF in
the core debugfs debugfs_remove() function, and has gone through
pushing for a CVE for this, CVE-2019-19770.

If correct then parent dentries are not positive, and this would
have implications far beyond this bug report. Thankfully, upon review
with Nicolai, he wasn't buying it. His suspicions that this was just
a blktrace issue were spot on, and this patch series demonstrates
that, provides a reproducer, and provides a solution to the issue.

We there would like to contend CVE-2019-19770 as invalid. The
implications suggested are not correct, and this issue is only
triggerable with root, by shooting yourself on the foot by misuing

If you want this on a git tree, you can get it from linux-next
20200401-blktrace-fix-uaf branch [2].

Wider review, testing, and rants are appreciated.


Luis Chamberlain (3):
block: move main block debugfs initialization to its own file
blktrace: fix debugfs use after free
block: avoid deferral of blk_release_queue() work

block/Makefile | 1 +
block/blk-core.c | 9 +--------
block/blk-debugfs.c | 27 +++++++++++++++++++++++++++
block/blk-mq-debugfs.c | 5 -----
block/blk-sysfs.c | 21 ++++++++-------------
block/blk.h | 17 +++++++++++++++++
include/linux/blktrace_api.h | 1 -
kernel/trace/blktrace.c | 19 ++++++++-----------
8 files changed, 62 insertions(+), 38 deletions(-)
create mode 100644 block/blk-debugfs.c


 \ /
  Last update: 2020-04-02 02:01    [W:0.178 / U:2.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site