From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752035AbcGSTjY (ORCPT <rfc822;w@1wt.eu>);
	Tue, 19 Jul 2016 15:39:24 -0400
Received: from zeniv.linux.org.uk ([195.92.253.2]:58922 "EHLO
	ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751696AbcGSTjU (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Tue, 19 Jul 2016 15:39:20 -0400
Date: Tue, 19 Jul 2016 20:38:57 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Dave Jones <davej@codemonkey.org.uk>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: 4.7-rc7: use-after-free in proc_map_files_readdir
Message-ID: <20160719193857.GI2356@ZenIV.linux.org.uk>
References: <CACVxJT-DnpFSj2WxU4gn8u0f8_UbTACw1_gbOe7RtxOwkWK10Q@mail.gmail.com>
 <20160719153145.GA11224@codemonkey.org.uk>
 <20160719162036.GG2356@ZenIV.linux.org.uk>
 <20160719183327.GA22621@codemonkey.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20160719183327.GA22621@codemonkey.org.uk>
User-Agent: Mutt/1.6.1 (2016-04-27)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Jul 19, 2016 at 02:33:27PM -0400, Dave Jones wrote:
>  > Could you dump the relevant part of vmlinux objdump, rather than whatever
>  > you've used on base.o?  Having relocations resolved makes it much easier
>  > to figure out...  Or just dump that vmlinux on anonftp somewhere...
> 
> http://codemonkey.org.uk/junk/vmlinux.gz

OK, it's actually about fetching ->f_mode in
                        info.mode = vma->vm_file->f_mode;

%r15 points contains vma->vm_file at that point, and 0x84 is the offset of
f_mode in struct file on your config from hell (due to spinlock_t size
exploding on lockdep et.al.)

Interesting...  Do you have a reproducer for that?