From: "Aurélien Aptel" <aaptel@suse.com>
To: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: sfrench@samba.org, linux-cifs@vger.kernel.org
Subject: Re: v5.1-rc1 cifs bug: underflow; use-after-free.
Date: Wed, 20 Mar 2019 12:12:21 +0100 [thread overview]
Message-ID: <871s316bqi.fsf@suse.com> (raw)
In-Reply-To: <20190319162645.GA3498@light.dominikbrodowski.net>
Dominik Brodowski <linux@dominikbrodowski.net> writes:
> Thanks for taking a look at this issue. Fortunately, it is easily
> reproducable (at least for me).
Which server are you doing this against? I couldn't reproduce against
Windows Server 2016.
>> If you enable verbose debugging [1], if my theory is correct you should
>> see a lease break messsage followed by "clear cached root file handle"
>> message before the warning.
>
> Hm, no.
Ok well I'm not sure what is happening then. But the final points still
stand:
- since we don't free anything in the release function, there is no
use-after-free.
- the access to the kref is already protected by crfid.fid_mutex so we
could replace it with a regular int and avoid the warning generated by
kref_put() that you see.
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
next prev parent reply other threads:[~2019-03-20 11:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-19 11:51 v5.1-rc1 cifs bug: underflow; use-after-free Dominik Brodowski
2019-03-19 15:26 ` Aurélien Aptel
2019-03-19 15:47 ` Aurélien Aptel
2019-03-19 16:26 ` Dominik Brodowski
2019-03-20 11:12 ` Aurélien Aptel [this message]
2019-03-26 7:18 ` Dominik Brodowski
2019-03-26 12:39 ` [PATCH v1] CIFS: prevent refcount underflow Aurelien Aptel
2019-03-26 15:46 ` Dominik Brodowski
2019-03-26 16:53 ` Aurélien Aptel
2019-03-26 16:53 ` Dominik Brodowski
2019-03-27 22:36 ` Pavel Shilovsky
2019-03-27 23:44 ` ronnie sahlberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871s316bqi.fsf@suse.com \
--to=aaptel@suse.com \
--cc=linux-cifs@vger.kernel.org \
--cc=linux@dominikbrodowski.net \
--cc=sfrench@samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.