Messages in this thread | | | Date | Sun, 24 Jul 2022 11:56:30 +0530 | From | Siddh Raman Pant <> | Subject | Re: [PATCH v2] kernel/watch_queue: Make pipe NULL while clearing watch_queue |
| |
On Sun, 24 Jul 2022 10:54:26 +0530 Hillf Danton <hdanton@sina.com> wrote: > According to sysbot's report [1], what is proposed fails to fix the > reported uaf in the scenario below because of no wqueue->lock acquired > in the post path. Despite of defunct checked, it is checked after taking > pipe's wait lock - a bit too late. > > Hillf > > post_one_notification watch_queue_clear > === === > pipe = wqueue->pipe; > if (!pipe) > return false; > spin_lock_bh(&wqueue->lock); > wqueue->pipe = NULL; > spin_lock_bh(&wqueue->lock); > > pipe is freed > > spin_lock_irq(&pipe->rd_wait.lock); // uaf reported > > if (wqueue->defunct) > goto out; > > [1] https://lore.kernel.org/lkml/000000000000aa07b205daba6d49@google.com/ >
Before post_one_notification(), in __post_watch_notification(), on line 228 wqueue->lock is acquired (using lock_wqueue()).
The comment on post_one_notification() also tells that it should be called with wqueue->lock held. So we do acquire the lock in the post path.
The pipe is freed after the execution of watch_queue_clear() in free_pipe_info().
A side note: Your emails don't seem to pop up on lore's LKML archive. Maybe check if the email isn't being blocked?
Thanks, Siddh
| |