From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Thu, 2 Mar 2017 00:13:34 +0100 From: Andrea Arcangeli To: Dmitry Vyukov Cc: Al Viro , "linux-fsdevel@vger.kernel.org" , LKML , Andrew Morton , Michal Hocko , "Kirill A. Shutemov" , Vlastimil Babka , Konstantin Khlebnikov , Andrey Ryabinin , "linux-mm@kvack.org" , syzkaller Subject: Re: fs: use-after-free in userfaultfd_exit Message-ID: <20170301231334.GO5816@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: owner-linux-mm@kvack.org List-ID: On Wed, Mar 01, 2017 at 07:48:00PM +0100, Dmitry Vyukov wrote: > Hello, > > I've got the following use-after-free report while running syzkaller > fuzzer on 86292b33d4b79ee03e2f43ea0381ef85f077c760: Yes, I posted the fix for this one last Friday, I found it during stress testing, it triggered the first time post-upstream merging despite I was running the same stress testing with SLUB poisoning enabled before. This affects all apps, also the ones that don't use userfaultfd, it's a locking issue. Furthermore the cost of userfaultfd_exit was not acceptable, if something it had to be activated by a flag in mm->flags (such an optimization would have been absolutely trivial though). Thankfully I realized another feature (UFFDIO_COPY -ENOSPC retval) can provide the same information at zero cost so I could drop userfaultfd_exit as a whole. https://marc.info/?l=linux-mm&m=148796041217814&w=2 The fix is already included in -mm along with the other fix for VM_FAULT_NOPAGE. Thanks, Andrea -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org