Messages in this thread | | | From | David Howells <> | Subject | Re: KASAN: slab-out-of-bounds Write in pipe_write | Date | Thu, 05 Dec 2019 16:33:56 +0000 |
| |
Eric Biggers <ebiggers@kernel.org> wrote:
> It looks like the 'mask' variable in pipe_write() is not being updated after > the pipe mutex was dropped in pipe_wait(), to take into account the pipe > size possibly having been changed in the mean time.
There's that, but not only that. Weirdness ensues if the ring size is 1 - this may have to do with the mask then being 0.
David
| |