| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 Jan 2014 16:05:01 +0100 From: Jan Kara <jack@...e.cz> To: Dave Jones <davej@...hat.com> Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Jan Kara <jack@...e.cz>, Linux Kernel <linux-kernel@...r.kernel.org>, Jiri Kosina <jkosina@...e.cz> Subject: Re: fanotify use after free. On Wed 22-01-14 19:32:40, Dave Jones wrote: > On Wed, Jan 22, 2014 at 04:08:52PM -0800, Linus Torvalds wrote: > > On Wed, Jan 22, 2014 at 3:36 PM, Jan Kara <jack@...e.cz> wrote: > > > > > > But refcounting seems like an overkill for this - there is exactly one > > > fanotify_response_event structure iff it is a permission event. So > > > something like the (completely untested) attached patch should fix the > > > problem. But I agree it's a bit ugly so we might want something different. > > > I'll try to think about something better tomorrow. > > > > Ok, In the meantime, Dave, can you verify whether this hacky patch > > fixes your problem? > > It actually seems worse. I see the tail end of what looks like a slab corruption > trace, and then a total lockup. And of course none of this makes it over ttyUSB0 > because it happens so early. Grr. Drat. Since this seems reasonably reproducible, I'll try to reproduce and debug this (it seems systemd is using fanotify in a way that triggers this). Thanks for testing. Honza -- Jan Kara <jack@...e.cz> SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists