[lkml]   [2018]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] idr: fix invalid ptr dereference on item delete
On Fri, 18 May 2018 10:50:25 -0700 Matthew Wilcox <> wrote:

> If the radix tree underlying the IDR happens to be full and we attempt
> to remove an id which is larger than any id in the IDR, we will call
> __radix_tree_delete() with an uninitialised 'slot' pointer, at which
> point anything could happen. This was easiest to hit with a single entry
> at id 0 and attempting to remove a non-0 id, but it could have happened
> with 64 entries and attempting to remove an id >= 64.
> Fixes: 0a835c4f090a ("Reimplement IDR and IDA using the radix tree")
> Reported-by:
> Debugged-by: Roman Kagan <>
> Signed-off-by: Matthew Wilcox <>

Neither of the changelogs I'm seeing attempt to describe the end-user
impact of the bug. People like to know that so they can decide which
kernel version(s) need patching, so please always remember it.

Looknig at the sysbot report, the impact is at least "privileged user
can trigger a WARN", but I assume there could be worse,
as-yet-undiscovered impacts. So I'm thinking a cc:stable is needed,

 \ /
  Last update: 2018-05-19 00:31    [W:0.039 / U:3.576 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site