linux-kernel - [GIT PULL] Fix too-short kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5c2748db-4811-4d3d-bdd3-0f005ffa275c@paulmck-laptop>
Date:   Mon, 10 Apr 2023 09:30:33 -0700
From:   "Paul E. McKenney" <paulmck@...nel.org>
To:     torvalds@...ux-foundation.org
Cc:     mingo@...nel.org, linux-kernel@...r.kernel.org, tglx@...utronix.de,
        rcu@...r.kernel.org, kernel-team@...com, rostedt@...dmis.org
Subject: [GIT PULL] Fix too-short kfree_rcu() grace period for v6.3

Hello, Linus,

This fixes an old bug rather than a v6.3 regression, but it is starting
to appear in the wild and has nasty memory-corruption consequences.
Please consider pulling this for v6.3.

The following changes since commit d18a04157fc171fd48075e3dc96471bd3b87f0dd:

  rcu: Fix rcu_torture_read ftrace event (2023-03-22 14:05:24 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git tags/urgent-rcu.2023.04.07a

for you to fetch changes up to 5da7cb193db32da783a3f3e77d8b639989321d48:

  rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period (2023-04-06 10:04:23 -0700)

----------------------------------------------------------------
Urgent RCU pull request for v6.3

This commit fixes a pair of bugs in which an improbable but very real
sequence of events can cause kfree_rcu() to be a bit too quick about
freeing the memory passed to it.  It turns out that this pair of bugs
is about two years old, and so this is not a v6.3 regression.  However:
(1) It just started showing up in the wild and (2) Its consequences are
dire, so its fix needs to go in sooner rather than later.

Testing is of course being upgraded, and the upgraded tests detect this
situation very quickly.  But to the best of my knowledge right now, the
tests are not particularly urgent and will thus most likely show up in
the v6.5 merge window (the one after this coming one).

Kudos to Ziwei Dai and his group for tracking this one down the hard way!

----------------------------------------------------------------
Ziwei Dai (1):
      rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period

 kernel/rcu/tree.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)