lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 1 Nov 2017 11:17:44 +0100 From: Andrea Arcangeli <aarcange@...hat.com> To: Vlastimil Babka <vbabka@...e.cz> Cc: "Kirill A. Shutemov" <kirill@...temov.name>, Dmitry Vyukov <dvyukov@...gle.com>, syzbot <bot+6a5269ce759a7bb12754ed9622076dc93f65a1f6@...kaller.appspotmail.com>, Jan Beulich <JBeulich@...e.com>, "H. Peter Anvin" <hpa@...or.com>, Josh Poimboeuf <jpoimboe@...hat.com>, "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, ldufour@...ux.vnet.ibm.com, LKML <linux-kernel@...r.kernel.org>, Andy Lutomirski <luto@...nel.org>, Ingo Molnar <mingo@...hat.com>, syzkaller-bugs@...glegroups.com, Thomas Gleixner <tglx@...utronix.de>, the arch/x86 maintainers <x86@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, Michal Hocko <mhocko@...e.com>, Hugh Dickins <hughd@...gle.com>, David Rientjes <rientjes@...gle.com>, linux-mm@...ck.org, Linus Torvalds <torvalds@...ux-foundation.org>, Thorsten Leemhuis <regressions@...mhuis.info> Subject: Re: KASAN: use-after-free Read in __do_page_fault On Wed, Nov 01, 2017 at 08:42:57AM +0100, Vlastimil Babka wrote: > The vma should be pinned by mmap_sem, but handle_userfault() will in some > scenarios release it and then acquire again, so when we return to In the above message and especially in the below comment, I would suggest to take the opportunity to more accurately document the specific scenario instead of "some scenario" which is only "A return to userland to repeat the page fault later with a VM_FAULT_NOPAGE retval (potentially after handling any pending signal during the return to userland). The return to userland is identified whenever FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in vmf->flags". > + * in some scenario (and not return VM_FAULT_RETRY), we have to be Thanks, Andrea
Powered by blists - more mailing lists