Re: KASAN: use-after-free Read in __io_uring_files_cancel

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 09/10/2020 15:35, Matthew Wilcox wrote:
> On Fri, Oct 09, 2020 at 03:28:54PM +0300, Pavel Begunkov wrote:
>> On 09/10/2020 15:12, Matthew Wilcox wrote:
>>>> It seems this fails on "node->shift" in xas_next_entry(), that would
>>>> mean that the node itself was freed while we're iterating on it.
>>>>
>>>> __io_uring_files_cancel() iterates with xas_next_entry() and creates
>>>> XA_STATE once by hand, but it also removes entries in the loop with
>>>> io_uring_del_task_file() -> xas_store(&xas, NULL); without updating
>>>> the iterating XA_STATE. Could it be the problem? See a diff below
>>>
>>> No, the problem is that the lock is dropped after calling
>>> xas_next_entry(), and at any point after calling xas_next_entry(),
>>> the node that it's pointing to can be freed.
>>
>> Only the task itself clears/removes entries, others can only insert.
>> So, could it be freed even though there are no parallel erases?
> 
> Not with today's implementation, but that's something that might
> change in the future.  I agree it's probably the task itself that's
> deleting the entry and causing the node to be deleted.

I see, then it looks like I narrowed it down right. But your
approach is cleaner anyway.

-- 
Pavel Begunkov



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux