Messages in this thread | | | From | Linus Torvalds <> | Date | Tue, 1 Aug 2017 10:53:17 -0700 | Subject | Re: [GIT PULL] Please pull NFS client changes for Linux 4.13 |
| |
On Tue, Aug 1, 2017 at 10:20 AM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > So I think the 'pathname' part may actually be entirely a red herring, > and it's the underlying access itself that just picks up a random > pointer from a stack that now contains something different. And KASAN > didn't notice the stale stack access itself, because the stack slot is > still valid - it's just no longer the original 'verifier' allocation. > > Or *something* like that.
I think the "something like that" is actually just reading the cdata->args.verifier->data pointer itself, and it *is* the stack access - but the stack page has been free'd (because of the same fatal signal that interrupted the rpc_wait_for_completion_task() call), and then re-allocated (and free'd again) as a pathname page.
Maybe.
Regardless, my patch still looks conceptually correct, even if it might have bugs due to total lack of testing.
Linus
| |