Messages in this thread | | | Date | Sat, 23 Jul 2022 16:03:33 +0200 | From | Greg KH <> | Subject | Re: [PATCH] kernel/watch_queue: Make pipe NULL while clearing watch_queue |
| |
On Sat, Jul 23, 2022 at 07:24:47PM +0530, Siddh Raman Pant via Linux-kernel-mentees wrote: > If not done, a reference to a freed pipe remains in the watch_queue, > as this function is called before freeing a pipe in free_pipe_info() > (see line 834 of fs/pipe.c). > > This causes a UAF when post_one_notification tries to access the pipe on > a key update, which is reported by syzbot. > > Bug report: https://syzkaller.appspot.com/bug?id=1870dd7791ba05f2ea7f47f7cbdde701173973fc > Reported-and-tested-by: syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com > > Signed-off-by: Siddh Raman Pant <code@siddh.me> > --- > kernel/watch_queue.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c > index bb9962b33f95..bab9e09c74cf 100644 > --- a/kernel/watch_queue.c > +++ b/kernel/watch_queue.c > @@ -637,8 +637,17 @@ void watch_queue_clear(struct watch_queue *wqueue) > spin_lock_bh(&wqueue->lock); > } > > - spin_unlock_bh(&wqueue->lock); > rcu_read_unlock(); > + > + /* Clearing the watch queue, so we should clean the associated pipe. */ > +#ifdef CONFIG_WATCH_QUEUE
You should not use #ifdef in .c files, it's unmaintainable over time.
thanks,
greg k-h
| |