linux-kernel - Re: [PATCH 4/6] mm, hwpoison: fix possible use-after-free in mf_dax_kill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220819081732.GA622828@hori.linux.bs1.fc.nec.co.jp>
Date:   Fri, 19 Aug 2022 08:17:32 +0000
From:   HORIGUCHI NAOYA(堀口　直也) 
        <naoya.horiguchi@....com>
To:     Miaohe Lin <linmiaohe@...wei.com>
CC:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4/6] mm, hwpoison: fix possible use-after-free in
 mf_dax_kill_procs()

On Fri, Aug 19, 2022 at 03:32:27PM +0800, Miaohe Lin wrote:
> On 2022/8/19 13:23, HORIGUCHI NAOYA(堀口 直也) wrote:
> > On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote:
> >> After kill_procs(), tk will be freed without being removed from the to_kill
> >> list. In the next iteration, the freed list entry in the to_kill list will
> >> be accessed, thus leading to use-after-free issue.
> > 
> > kill_procs() runs over the to_kill list and frees all listed items in each
> > iteration.  So just after returning from unmap_and_kill(), to_kill->next and
> > to_kill->prev still point to the addresses of struct to_kill which was the
> > first or last item (already freed!).  This is bad-manered, but
> > collect_procs_fsdax() in the next iteration calls list_add_tail() and
> > overwrites the dangling pointers with newly allocated item.  So this problem
> 
> list_add_tail will do WRITE_ONCE(prev->next, new) where prev is already freed!
> Or am I miss something?

No, you're right. Thank you for explanation.

Thanks,
Naoya Horiguchi