linux-kernel - Re: [PATCH] filelock: fix potential use-after-free in posix_lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK-6q+hCQNg8XK7v86hhgsgPu2c_aN_+xRZBzTG7DQ-fee8vRg@mail.gmail.com>
Date: Tue, 2 Jul 2024 21:19:36 -0400
From: Alexander Aring <aahringo@...hat.com>
To: Jeff Layton <jlayton@...nel.org>
Cc: Chuck Lever <chuck.lever@...cle.com>, Alexander Aring <alex.aring@...il.com>, 
	Alexander Viro <viro@...iv.linux.org.uk>, Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, 
	Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
	linux-mediatek@...ts.infradead.org, 
	Light Hsieh (謝明燈) <Light.Hsieh@...iatek.com>
Subject: Re: [PATCH] filelock: fix potential use-after-free in posix_lock_inode

Hi,

On Tue, Jul 2, 2024 at 6:45 PM Jeff Layton <jlayton@...nel.org> wrote:
>
> Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode().
> The request pointer had been changed earlier to point to a lock entry
> that was added to the inode's list. However, before the tracepoint could
> fire, another task raced in and freed that lock.
>
> Fix this by moving the tracepoint inside the spinlock, which should
> ensure that this doesn't happen.
>

makes sense to me. Thanks.

Reviewed-by: Alexander Aring <aahringo@...hat.com>

- Alex