From: Gao Xiang <xiang@kernel.org>
To: Michael Bommarito <michael.bommarito@gmail.com>
Cc: Gao Xiang <xiang@kernel.org>, Sasha Levin <sashal@kernel.org>,
stable@vger.kernel.org, Chao Yu <chao@kernel.org>,
linux-erofs@lists.ozlabs.org
Subject: Re: Patch "erofs: remove fscache backend entirely" has been added to the 6.18-stable tree
Date: Tue, 13 Oct 2026 13:22:28 +0200 [thread overview]
Message-ID: <as4UdEWzIr2O_M31@MacBookPro> (raw)
In-Reply-To: <20261013111011.2814836-1-michael.bommarito@gmail.com>
Hi Michael,
On Tue, Oct 13, 2026 at 07:10:11AM -0400, Michael Bommarito wrote:
> For context, the original bug I found can hit both 100% deterministic
> local DoS and a textbook UAF on kmalloc-128 slab that requires timing,
> but I don't think an LPE can be ruled out...
>
> Since it is reachable by an ordinary read() on Nydus or others that
> enabled ondemand in Kconfig, I think it is worth thinking about what to
> do for all of the pre-deprecation users (even if it's just comms).
>
> I would defer to Gao, but I sent a minimal fix in June that can
> close the UAF without any other breaking changes.
Do you mean this one?
https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com
As I requested months ago, could you please provide a reproducer first
so I can play with your patch.
If you provide a minimal reproducer, of course we could address this in
the stable kernels.
Thanks,
Gao Xiang
>
> Thanks,
> Michael Bommarito
>
prev parent reply other threads:[~2026-10-13 11:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261013020044.2527207-1-sashal@kernel.org>
2026-10-13 7:28 ` Patch "erofs: remove fscache backend entirely" has been added to the 6.18-stable tree Gao Xiang
2026-10-13 7:59 ` Greg KH
2026-10-13 8:16 ` Gao Xiang
2026-10-13 10:37 ` Greg KH
2026-10-13 11:30 ` Gao Xiang
2026-10-13 11:10 ` Michael Bommarito
2026-10-13 11:22 ` Gao Xiang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=as4UdEWzIr2O_M31@MacBookPro \
--to=xiang@kernel.org \
--cc=chao@kernel.org \
--cc=linux-erofs@lists.ozlabs.org \
--cc=michael.bommarito@gmail.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.