From: Greg KH <gregkh@linuxfoundation.org>
To: genjian zhang <zhanggenjian@126.com>
Cc: stable@vger.kernel.org, axboe@kernel.dk, stable@kernel.org,
linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
zhanggenjian123@gmail.com,
Genjian Zhang <zhanggenjian@kylinos.cn>
Subject: Re: Re: [PATCH 4.19.y 0/9] Fix the UAF issue caused by the loop driver
Date: Fri, 29 Mar 2024 13:38:48 +0100 [thread overview]
Message-ID: <2024032938-preface-reassure-a1f4@gregkh> (raw)
In-Reply-To: <1d74f009.2179.18e16c2d99f.Coremail.zhanggenjian@126.com>
On Thu, Mar 07, 2024 at 10:34:12AM +0800, genjian zhang wrote:
>
> At 2024-03-04 21:31:20, "Greg KH" <gregkh@linuxfoundation.org> wrote:
> >On Fri, Mar 01, 2024 at 09:30:19AM +0800, Genjian wrote:
> >> From: Genjian Zhang <zhanggenjian@kylinos.cn>
> >>
> >> Hello!
> >>
> >> We found that 2035c770bfdb ("loop: Check for overflow while configuring loop") lost a unlock loop_ctl_mutex in loop_get_status(...).
> >> which caused syzbot to report a UAF issue. However, the upstream patch does not have this issue.
> >> So, we revert this patch and directly apply the unmodified upstream patch.
> >>
> >> Risk use-after-free as reported by syzbot：
> >
> >This looks good, but you are backporting commits that are NOT in newer
> >stable releases (i.e. from 5.8 but the commit is not in 5.4.y), is that
> >intentional?
> >
> >Does 5.4.y also have this problem? If so, can you send a series that
> >fixes that up so I can take both of them at the same time?
> >
> >thanks,
> >
> >greg k-h
>
> Thank you for your advice. This problem also exists in 5.4.y.
> I will send a series of patches for 5.4.y.
All now queued up, thanks!
greg k-h
prev parent reply other threads:[~2024-03-29 12:38 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-01 1:30 [PATCH 4.19.y 0/9] Fix the UAF issue caused by the loop driver Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 1/9] Revert "loop: Check for overflow while configuring loop" Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 2/9] loop: Call loop_config_discard() only after new config is applied Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 3/9] loop: Remove sector_t truncation checks Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 4/9] loop: Factor out setting loop device size Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 5/9] loop: Refactor loop_set_status() size calculation Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 6/9] loop: properly observe rotational flag of underlying device Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 7/9] loop: Factor out configuring loop from status Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 8/9] loop: Check for overflow while configuring loop Genjian
2024-03-01 1:30 ` [PATCH 4.19.y 9/9] loop: loop_set_status_from_info() check before assignment Genjian
2024-03-04 13:31 ` [PATCH 4.19.y 0/9] Fix the UAF issue caused by the loop driver Greg KH
2024-03-07 2:34 ` genjian zhang
2024-03-29 12:38 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024032938-preface-reassure-a1f4@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
--cc=zhanggenjian123@gmail.com \
--cc=zhanggenjian@126.com \
--cc=zhanggenjian@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox