Re: [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()

To: Eric Biggers <ebiggers3@xxxxxxxxx>
Subject: Re: [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()
From: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Date: Mon, 9 Apr 2018 13:26:41 -0700
Cc: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>, linux-mm@xxxxxxxxx, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, linux-fsdevel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>, "Eric W . Biederman" <ebiederm@xxxxxxxxxxxx>, syzkaller-bugs@xxxxxxxxxxxxxxxx
In-reply-to: <20180409201232.3rweldbjtvxjj5ql@linux-n805>
Mail-followup-to: Eric Biggers <ebiggers3@xxxxxxxxx>, "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>, linux-mm@xxxxxxxxx, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, linux-fsdevel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>, "Eric W . Biederman" <ebiederm@xxxxxxxxxxxx>, syzkaller-bugs@xxxxxxxxxxxxxxxx
References: <94eb2c06f65e5e2467055d036889@google.com> <20180409043039.28915-1-ebiggers3@gmail.com> <20180409094813.bsjc3u2hnsrdyiuk@black.fi.intel.com> <20180409185016.GA203367@gmail.com> <20180409201232.3rweldbjtvxjj5ql@linux-n805>
User-agent: NeoMutt/20170421 (1.8.2)

On Mon, 09 Apr 2018, Davidlohr Bueso wrote:

So I don't think the pointer is going anywhere, or am I missing
something?


Ah, yes, wrong pointer, this is sdf->file -- sorry for the noise.

References:
- [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()
  - From: Eric Biggers
- Re: [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()
  - From: Kirill A. Shutemov
- Re: [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()
  - From: Eric Biggers
- Re: [PATCH] ipc/shm: fix use-after-free of shm file via remap_file_pages()
  - From: Davidlohr Bueso