linux-kernel - Re: [syzbot] [v9fs?] KASAN: slab-use-after-free Write in v9fs_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 May 2024 11:56:52 +0100
From: David Howells <dhowells@...hat.com>
To: asmadeus@...ewreck.org
Cc: dhowells@...hat.com,
    syzbot <syzbot+df038d463cca332e8414@...kaller.appspotmail.com>,
    ericvh@...nel.org, linux-kernel@...r.kernel.org,
    linux_oss@...debyte.com, lucho@...kov.net,
    syzkaller-bugs@...glegroups.com, v9fs@...ts.linux.dev
Subject: Re: [syzbot] [v9fs?] KASAN: slab-use-after-free Write in v9fs_free_request

asmadeus@...ewreck.org wrote:

> That's a tough one: netfs took a ref in v9fs_init_request (netfs op's
> init_request) and expects to be able to use it until v9fs_free_request
> (net op's free_request()), but the fs was dismounted first and we kill
> the kmem cache at this point so we aggressively drop any dangling ref
> there as there's no way of waiting.

Which kmem cache are we talking about?  I can see two in net/9p/ and one in
fs/9p/.  And took a ref on what?

David