linux-kernel - Re: [syzbot] [fs?] [wireless?] general protection fault in simple_recursive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250725002008.GX2580412@ZenIV>
Date: Fri, 25 Jul 2025 01:20:08 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Moon Hee Lee <moonhee.lee.ca@...il.com>
Cc: syzbot+d6ccd49ae046542a0641@...kaller.appspotmail.com,
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [fs?] [wireless?] general protection fault in
 simple_recursive_removal (5)

On Thu, Jul 24, 2025 at 10:29:47AM -0700, Moon Hee Lee wrote:
> On Thu, Jul 24, 2025 at 8:58 AM Al Viro <viro@...iv.linux.org.uk> wrote:
> > It might paper over the specific reproducer, but that's not a fix...
> > I'm not familiar with that code; will check the details, but in
> > this form it is obviously still racy.
> 
> Thanks for the feedback, Al.
> 
> Agreed, this only papers over the issue. I'm tracing the
> sta_info_destroy() path to confirm the race and will follow up with a
> proper fix if confirmed.

Note that if you have nested subtrees, you have to be very careful
about removals - after all, removal of the bigger one drops the
references we are holding to the roots of the smaller ones.