From: Eric Biggers <ebiggers@kernel.org>
To: Siddh Raman Pant <code@siddh.me>
Cc: syzbot+c70d87ac1d001f29a058
<syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
linux-security-modules <linux-security-module@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
David Howells <dhowells@redhat.com>,
Eric Dumazet <edumazet@google.com>,
Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
"Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Subject: Re: [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue
Date: Tue, 2 Aug 2022 22:41:31 -0700 [thread overview]
Message-ID: <YuoKi0GigXm/Hcb+@sol.localdomain> (raw)
In-Reply-To: <182621f8dca.1e0e6161130907.1470656861897824669@siddh.me>
On Wed, Aug 03, 2022 at 10:43:31AM +0530, Siddh Raman Pant wrote:
> On Wed, 03 Aug 2022 09:42:28 +0530 Eric Biggers <ebiggers@kernel.org> wrote:
> > Under what circumstances is the pipe pointer still being dereferenced after the
> > pipe has been freed? I don't see how it can be; see my explanation above.
>
> It really didn't fix the crash. It caused the same crash reported here, which
> I was already locally getting:
> https://syzkaller.appspot.com/bug?extid=03d7b43290037d1f87ca
I tested the syzbot reproducer
https://syzkaller.appspot.com/text?tag=ReproC&x=174ea97e080000, and it does
*not* trigger the bug on the latest upstream. But, it does trigger the bug if I
recent Linus's recent watch_queue fixes.
So I don't currently see any evidence of an unfixed bug. If, nevertheless, you
believe that a bug is still unfixed, then please provide a reproducer and a fix
patch that clearly explains what it is fixing.
> There is a null check in post_one_notification for the pipe, most probably
> because it *expects* the pointer to be NULL'd. Also, there is no reason to have
> a dangling pointer stay, it's just a recipe for further bugs.
If you want to send a patch or patches to clean up the code, that is fine, but
please make it super clear what is a cleanup and what is a fix.
- Eric
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
WARNING: multiple messages have this Message-ID (diff)
From: Eric Biggers <ebiggers@kernel.org>
To: Siddh Raman Pant <code@siddh.me>
Cc: David Howells <dhowells@redhat.com>,
Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
Eric Dumazet <edumazet@google.com>,
"Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
linux-security-modules <linux-security-module@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
syzbot+c70d87ac1d001f29a058
<syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com>
Subject: Re: [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue
Date: Tue, 2 Aug 2022 22:41:31 -0700 [thread overview]
Message-ID: <YuoKi0GigXm/Hcb+@sol.localdomain> (raw)
In-Reply-To: <182621f8dca.1e0e6161130907.1470656861897824669@siddh.me>
On Wed, Aug 03, 2022 at 10:43:31AM +0530, Siddh Raman Pant wrote:
> On Wed, 03 Aug 2022 09:42:28 +0530 Eric Biggers <ebiggers@kernel.org> wrote:
> > Under what circumstances is the pipe pointer still being dereferenced after the
> > pipe has been freed? I don't see how it can be; see my explanation above.
>
> It really didn't fix the crash. It caused the same crash reported here, which
> I was already locally getting:
> https://syzkaller.appspot.com/bug?extid=03d7b43290037d1f87ca
I tested the syzbot reproducer
https://syzkaller.appspot.com/text?tag=ReproC&x=174ea97e080000, and it does
*not* trigger the bug on the latest upstream. But, it does trigger the bug if I
recent Linus's recent watch_queue fixes.
So I don't currently see any evidence of an unfixed bug. If, nevertheless, you
believe that a bug is still unfixed, then please provide a reproducer and a fix
patch that clearly explains what it is fixing.
> There is a null check in post_one_notification for the pipe, most probably
> because it *expects* the pointer to be NULL'd. Also, there is no reason to have
> a dangling pointer stay, it's just a recipe for further bugs.
If you want to send a patch or patches to clean up the code, that is fine, but
please make it super clear what is a cleanup and what is a fix.
- Eric
next prev parent reply other threads:[~2022-08-03 5:41 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-28 15:51 [PATCH v3] kernel/watch_queue: Make pipe NULL while clearing watch_queue Siddh Raman Pant via Linux-kernel-mentees
2022-07-28 15:51 ` Siddh Raman Pant
2022-08-01 9:34 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-01 9:34 ` Siddh Raman Pant
2022-08-01 10:24 ` Greg KH
2022-08-01 10:24 ` Greg KH
2022-08-01 12:58 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-01 12:58 ` Siddh Raman Pant
2022-08-01 13:00 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-01 13:00 ` Siddh Raman Pant
2022-08-01 16:16 ` Dipanjan Das
2022-08-01 16:16 ` Dipanjan Das
2022-08-01 18:49 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-01 18:49 ` Siddh Raman Pant
2022-08-03 1:16 ` Eric Biggers
2022-08-03 1:16 ` Eric Biggers
2022-08-03 3:58 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-03 3:58 ` Siddh Raman Pant
2022-08-03 4:10 ` Dipanjan Das
2022-08-03 4:10 ` Dipanjan Das
2022-08-03 1:08 ` Eric Biggers
2022-08-03 1:08 ` Eric Biggers
2022-08-03 3:56 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-03 3:56 ` Siddh Raman Pant
2022-08-03 4:12 ` Eric Biggers
2022-08-03 4:12 ` Eric Biggers
2022-08-03 5:13 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-03 5:13 ` Siddh Raman Pant
2022-08-03 5:41 ` Eric Biggers [this message]
2022-08-03 5:41 ` Eric Biggers
2022-08-03 8:40 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-03 8:40 ` Siddh Raman Pant
2022-08-03 18:15 ` Eric Biggers
2022-08-03 18:15 ` Eric Biggers
2022-08-04 8:39 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-04 8:39 ` Siddh Raman Pant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YuoKi0GigXm/Hcb+@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=christophe.jaillet@wanadoo.fr \
--cc=code@siddh.me \
--cc=dhowells@redhat.com \
--cc=edumazet@google.com \
--cc=fmdefrancesco@gmail.com \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.