Re: v5.1-rc1 cifs bug: underflow; use-after-free.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Mar 20, 2019 at 12:12:21PM +0100, Aurélien Aptel wrote:
> Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx> writes:
> > Thanks for taking a look at this issue. Fortunately, it is easily
> > reproducable (at least for me).
> 
> Which server are you doing this against? I couldn't reproduce against
> Windows Server 2016.

Had to find that out first, as I'm merely a user here: It's OES 2015 with
Samba version 3.6.3.

> >> If you enable verbose debugging [1], if my theory is correct you should
> >> see a lease break messsage followed by "clear cached root file handle"
> >> message before the warning.
> >
> > Hm, no.
> 
> Ok well I'm not sure what is happening then. But the final points still
> stand:
> 
> - since we don't free anything in the release function, there is no
>   use-after-free.
> - the access to the kref is already protected by crfid.fid_mutex so we
>   could replace it with a regular int and avoid the warning generated by
>   kref_put() that you see.  

If you have a patch ready, I can easily test that.

Thanks,
	Dominik



[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux