linux-kernel - Re: [PATCH v1 1/2] perf maps: Avoid RC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <176366534773.3323482.11545683532910788298.b4-ty@kernel.org>
Date: Thu, 20 Nov 2025 11:02:27 -0800
From: Namhyung Kim <namhyung@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, 
 Arnaldo Carvalho de Melo <acme@...nel.org>, 
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>, 
 Jiri Olsa <jolsa@...nel.org>, Adrian Hunter <adrian.hunter@...el.com>, 
 James Clark <james.clark@...aro.org>, German Gomez <german.gomez@....com>, 
 Ravi Bangoria <ravi.bangoria@....com>, 
 Christophe Leroy <christophe.leroy@...roup.eu>, 
 Chun-Tse Shao <ctshao@...gle.com>, linux-perf-users@...r.kernel.org, 
 linux-kernel@...r.kernel.org, kernel test robot <oliver.sang@...el.com>, 
 Ian Rogers <irogers@...gle.com>
Subject: Re: [PATCH v1 1/2] perf maps: Avoid RC_CHK use after free

On Tue, 18 Nov 2025 21:05:54 -0800, Ian Rogers wrote:
> The case of __maps__fixup_overlap_and_insert where the "new" maps
> covers existing mappings can create a use-after-free with reference
> count checking enabled. The issue is that "pos" holds a map pointer
> from maps_by_address that is put from maps_by_address but then used to
> look for a map in maps_by_name (the compared map is now a
> use-after-free). The issue stems from using maps__remove which redoes
> some of the searches already done by __maps__fixup_overlap_and_insert,
> so optimize the code (by avoiding repeated searches) and avoid the
> use-after-free by inlining the appropriate removal code.
> 
> [...]
Applied to perf-tools-next, thanks!

Best regards,
Namhyung