From: Al Viro <viro@ZenIV.linux.org.uk>
To: Dave Jones <davej@codemonkey.org.uk>,
Alexey Dobriyan <adobriyan@gmail.com>,
Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: 4.7-rc7: use-after-free in proc_map_files_readdir
Date: Tue, 19 Jul 2016 20:38:57 +0100 [thread overview]
Message-ID: <20160719193857.GI2356@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20160719183327.GA22621@codemonkey.org.uk>
On Tue, Jul 19, 2016 at 02:33:27PM -0400, Dave Jones wrote:
> > Could you dump the relevant part of vmlinux objdump, rather than whatever
> > you've used on base.o? Having relocations resolved makes it much easier
> > to figure out... Or just dump that vmlinux on anonftp somewhere...
>
> http://codemonkey.org.uk/junk/vmlinux.gz
OK, it's actually about fetching ->f_mode in
info.mode = vma->vm_file->f_mode;
%r15 points contains vma->vm_file at that point, and 0x84 is the offset of
f_mode in struct file on your config from hell (due to spinlock_t size
exploding on lockdep et.al.)
Interesting... Do you have a reproducer for that?
next prev parent reply other threads:[~2016-07-19 19:39 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-19 11:16 4.7-rc7: use-after-free in proc_map_files_readdir Alexey Dobriyan
2016-07-19 15:31 ` Dave Jones
2016-07-19 16:20 ` Al Viro
2016-07-19 18:33 ` Dave Jones
2016-07-19 19:38 ` Al Viro [this message]
2016-07-19 19:47 ` Dave Jones
2016-07-20 13:14 ` Dave Jones
2016-07-19 19:28 ` Alexey Dobriyan
-- strict thread matches above, loose matches on Subject: below --
2016-07-18 23:24 Dave Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160719193857.GI2356@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=adobriyan@gmail.com \
--cc=davej@codemonkey.org.uk \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.