linux-kernel - Re: Re: [PATCH] libfs: Fix NULL pointer access in simple_recursive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20251126083648.50513-1-r4o5m6e8o@163.com>
Date: Wed, 26 Nov 2025 16:36:48 +0800
From: "rom.wang" <r4o5m6e8o@....com>
To: viro@...iv.linux.org.uk
Cc: brauner@...nel.org,
	gregkh@...uxfoundation.org,
	jack@...e.cz,
	linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	r4o5m6e8o@....com,
	stable@...r.kernel.org,
	wangyufeng@...inos.cn
Subject: Re: Re: [PATCH] libfs: Fix NULL pointer access in simple_recursive_removal

	Yes, thank you, i aggree with your suggest dentry has already beed freed, and i can got the dentry.d_name.name info is "vcpu126" from debug vmcore, and it's parent dentry is "xxxpid_xx" which's d_inode is NULL too., but the parent of "xxxpid_xx" dentry is "kvm" which's d_inode is not NULL. and after checking the source, i guest the root reason is kvm->debugfs_dentry has been freed before freeing vcpu->debugfs_dentry. and the vmcore kernel version is 4.19. 

[Patch that introduced the issue]
In commit 3d75b8aa5c2 ("KVM: Always flush async #PF workqueue when vCPU is being destroyed"),
the kvm_get_kvm(work->vcpu->kvm) call was removed from kvm_setup_async_pf,
but the corresponding kvm_put_kvm(work->vcpu->kvm) call was not removed.

[Patch that fixes the issue]
Commit 7863e346e108 ("KVM: async_pf: Cleanup kvm_setup_async_pf()") 
will remove the kvm_put_kvm(work->vcpu->kvm) call.

if cherry-pick Commit 7863e346e108 ("KVM: async_pf: Cleanup kvm_setup_async_pf()") to 4.19 brach can fix this issue.