linux-kernel - Re: KASAN: use-after-free Read in userfaultfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 20 Jul 2020 16:46:00 -0700
From:   Daniel Colascione <dancol@...col.org>
To:     Al Viro <viro@...iv.linux.org.uk>, Hillf Danton <hdanton@...a.com>
Cc:     syzbot <syzbot+75867c44841cb6373570@...kaller.appspotmail.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com,
        Markus Elfring <Markus.Elfring@....de>
Subject: Re: KASAN: use-after-free Read in userfaultfd_release (2)

On 7/20/20 9:00 AM, Al Viro wrote:
> On Mon, Jul 13, 2020 at 04:45:12PM +0800, Hillf Danton wrote:
> 
>> Bridge the gap between slab free and the fput in task work wrt
>> file's private data.
> 
> No.  This
> 
>> @@ -2048,6 +2055,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
>>   
>>   	fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
>>   	if (fd < 0) {
>> +		file->private_data = NULL;
>>   		fput(file);
>>   		goto out;
>>   	}
>>
> 
> is fundamentally wrong; you really shouldn't take over the cleanups
> if you ever do fput().

Yep. I don't recall how the O_CLOEXEC got in there: that's indeed wrong, 
and probably the result of patch-editing butchery. As for the exit 
cleanup: yes, that's a bug. I was trying to keep the exit paths 
together. We could fix it forward (which seems simple enough) or re-submit.